CVE-2024-58100

In the Linux kernel, the following vulnerability has been resolved:

bpf: check changes_pkt_data property for extension programs

When processing calls to global sub-programs, verifier decides whether to invalidate all packet pointers in current state depending on the changes_pkt_data property of the global sub-program.

Because of this, an extension program replacing a global sub-program must be compatible with changes_pkt_data property of the sub-program being replaced.

This commit:

• adds changes_pkt_data flag to struct bpf_prog_aux:

  • this flag is set in check_cfg() for main sub-program;
  • in jit_subprogs() for other sub-programs;

• modifies bpf_check_attach_btf_id() to check changes_pkt_data flag;

• moves call to check_attach_btf_id() after the call to check_cfg(), because it needs changes_pkt_data flag to be set:

  bpf_check: ... ...

  • check_attach_btf_id resolve_pseudo_ldimm64 resolve_pseudo_ldimm64 --> bpf_prog_is_offloaded bpf_prog_is_offloaded check_cfg check_cfg + check_attach_btf_id ... ...

The following fields are set by check_attach_btf_id():

• env->ops
• prog->aux->attach_btf_trace
• prog->aux->attach_func_name
• prog->aux->attach_func_proto
• prog->aux->dst_trampoline
• prog->aux->mod
• prog->aux->saved_dst_attach_type
• prog->aux->saved_dst_prog_type
• prog->expected_attach_type

Neither of these fields are used by resolve_pseudo_ldimm64() or bpf_prog_offload_verifier_prep() (for netronome and netdevsim drivers), so the reordering is safe.

This vulnerability is rated as Moderate impact because exploitation requires local access with elevated administrative privileges (specifically CAP_BPF or CAP_SYS_ADMIN) to load and attach BPF extension programs. In standard Red Hat Enterprise Linux environments, unprivileged eBPF is disabled by default, preventing unprivileged users from reaching the affected code path. Although inconsistent packet pointer tracking between extension programs and replaced subprograms could result in kernel memory corruption or a denial of service, the strict privilege requirement significantly limits the exposure on typical deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.