Medium · published June 21, 2024
In the Linux kernel, the following vulnerability has been resolved:
bpf: Allow delete from sockmap/sockhash only if update is allowed
We have seen an influx of syzkaller reports where a BPF program attached to
a tracepoint triggers a locking rule violation by performing a map_delete
on a sockmap/sockhash.
We don't intend to support this artificial use scenario. Extend the
existing verifier allowed-program-type check for updating sockmap/sockhash
to also cover deleting from a map.
From now on only BPF programs which were previously allowed to update
sockmap/sockhash can delete from these map types.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.10, < 5.10.219 | 5.10.219 |
| linux/linux_kernel | ≥ 5.15, < 5.15.161 | 5.15.161 |
| linux/linux_kernel | ≥ 6.1, < 6.1.93 | 6.1.93 |
| linux/linux_kernel | ≥ 6.6, < 6.6.33 | 6.6.33 |
| linux/linux_kernel | ≥ 6.9, < 6.9.4 | 6.9.4 |
| linux/linux_kernel | all versions | — |