Junglewise Threat Intelligence

CVE-2024-26884: Linux Kernel integer overflow in BPF hashtab on 32-bit architectures

CVE-2024-26884 · Severity: high · CVSS 7.8 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) component on 32-bit systems. This component is used for high-performance networking and system monitoring. An attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive data by triggering an integer overflow during memory allocation.

Technical details

An integer overflow vulnerability exists in kernel/bpf/hashtab.c within the Linux kernel. The hashtab code uses roundup_pow_of_two() to calculate the number of hash buckets based on max_entries. On 32-bit architectures, this function can perform a 32-bit left-shift on an unsigned long, leading to undefined behavior and bypassing subsequent overflow checks that expect a zero value on failure. An attacker with local privileges can trigger this by creating a BPF map with a specifically crafted number of entries, potentially leading to out-of-bounds memory access or a kernel crash. The fix involves moving the overflow check to occur before the roundup operation.

Affected products

  • Linux Linux Kernel 3.19 to 4.19.311, 4.20 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-03-07: patched: Initial patch authored by Toke Høiland-Jørgensen
  • 2024-04-17: disclosed: CVE published

References

Related threats