Junglewise Threat Intelligence

CVE-2024-26883: Linux Kernel integer overflow in BPF stackmap on 32-bit architectures

CVE-2024-26883 · Severity: high · CVSS 7.8 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem on 32-bit systems. This component is used for high-performance networking and system monitoring. An attacker with local access could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive data, impacting the overall stability and security of the operating system.

Technical details

The vulnerability is an integer overflow in the BPF stackmap implementation (kernel/bpf/stackmap.c) specifically affecting 32-bit architectures. The code uses 'roundup_pow_of_two()' to calculate hash bucket sizes based on user-provided 'max_entries'. On 32-bit systems, this function can perform a 32-bit left-shift on an unsigned long, leading to undefined behavior and failing to trigger the subsequent zero-check for overflows. A local attacker can provide a large 'max_entries' value to bypass the overflow check, leading to incorrect memory allocation sizes. This can result in out-of-bounds memory access or a kernel panic. Patches have been released across multiple stable kernel branches to check the input value before the rounding operation.

Affected products

  • Linux Linux Kernel 4.9.258 to 4.10, 4.14.222 to 4.15, 4.19.177 to 4.19.311, 5.4.99 to 5.4.273, 5.10.17 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-03-07: disclosed: Initial patch submitted by Toke Høiland-Jørgensen
  • 2024-03-26: patched: Patches committed to various stable kernel branches
  • 2024-04-17: advisory: CVE-2024-26883 published

References

Related threats