CVE-2024-58098

In the Linux kernel, the following vulnerability has been resolved:

bpf: track changes_pkt_data property for global functions

When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. For example, consider the following program:

__attribute__((__noinline__))
long skb_pull_data(struct __sk_buff *sk, __u32 len)
{
    return bpf_skb_pull_data(sk, len);
}

SEC("tc")
int test_invalidate_checks(struct __sk_buff *sk)
{
    int *p = (void *)(long)sk->data;
    if ((void *)(p + 1) > (void *)(long)sk->data_end) return TCX_DROP;
    skb_pull_data(sk, 0);
    *p = 42;
    return TCX_PASS;
}

After a call to bpf_skb_pull_data() the pointer 'p' can't be used safely. See function filter.c:bpf_helper_changes_pkt_data() for a list of such helpers.

At the moment verifier invalidates packet pointers when processing helper function calls, and does not traverse global sub-programs when processing calls to global sub-programs. This means that calls to helpers done from global sub-programs do not invalidate pointers in the caller state. E.g. the program above is unsafe, but is not rejected by verifier.

This commit fixes the omission by computing field bpf_subprog_info->changes_pkt_data for each sub-program before main verification pass. changes_pkt_data should be set if:

• subprogram calls helper for which bpf_helper_changes_pkt_data returns true;
• subprogram calls a global function, for which bpf_subprog_info->changes_pkt_data should be set.

The verifier.c:check_cfg() pass is modified to compute this information. The commit relies on depth first instruction traversal done by check_cfg() and absence of recursive function calls:

• check_cfg() would eventually visit every call to subprogram S in a state when S is fully explored;
• when S is fully explored:
  • every direct helper call within S is explored (and thus changes_pkt_data is set if needed);
  • every call to subprogram S1 called by S was visited with S1 fully explored (and thus S inherits changes_pkt_data from S1).

The downside of such approach is that dead code elimination is not taken into account: if a helper call inside global function is dead because of current configuration, verifier would conservatively assume that the call occurs for the purpose of the changes_pkt_data computation.

This vulnerability is classified as having Moderate severity for Red Hat Enterprise Linux because exploiting it requires privileged access, specifically capabilities such as CAP_BPF or CAP_NET_ADMIN, to load the relevant BPF programs. By default, unprivileged users cannot load extended Berkeley Packet Filter (eBPF) programs, and helper routines that alter network packet buffers are restricted to privileged network control contexts. Consequently, an attacker must already possess administrative privileges to load an eBPF program with global functions that bypasses verifier safety checks, limiting the threat to local privilege escalation or kernel denial of service in already trusted environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.