CVE-2024-26591

bpf: Fix re-attachment branch in bpf_tracing_prog_attach

published February 22, 2024

CVSS
—
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix re-attachment branch in bpf_tracing_prog_attach

The following case can cause a crash due to missing attach_btf:

1) load rawtp program

2) load fentry program with rawtp as target_fd

3) create tracing link for fentry program with target_fd = 0

4) repeat 3

In the end we have:

- prog->aux->dst_trampoline == NULL

- tgt_prog == NULL (because we did not provide target_fd to link_create)

- prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X)

- the program was loaded for tgt_prog but we have no way to find out which one

BUG: kernel NULL pointer dereference, address: 0000000000000058

Call Trace:

<TASK>

? __die+0x20/0x70

? page_fault_oops+0x15b/0x430

? fixup_exception+0x22/0x330

? exc_page_fault+0x6f/0x170

? asm_exc_page_fault+0x22/0x30

? bpf_tracing_prog_attach+0x279/0x560

? btf_obj_id+0x5/0x10

bpf_tracing_prog_attach+0x439/0x560

__sys_bpf+0x1cf4/0x2de0

__x64_sys_bpf+0x1c/0x30

do_syscall_64+0x41/0xf0

entry_SYSCALL_64_after_hwframe+0x6e/0x76

Return -EINVAL in this situation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.0th percentile
Published
2024-02-22T16:21Z
EPSS history
Timeline
  • 22 FEB 16:21Z
    bpf: Fix re-attachment branch in bpf_tracing_prog_attach
    cvelistv5