Junglewise Threat Intelligence

CVE-2024-26885: Linux Kernel integer overflow in BPF DEVMAP_HASH on 32-bit arches

CVE-2024-26885 · Severity: high · CVSS 7.8 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's networking component (BPF devmap) on 32-bit systems. An attacker with local access could trigger a system crash or potentially gain unauthorized control by providing specially crafted configuration values. This could lead to a complete denial of service or compromise of the affected system's data and operations.

Technical details

An integer overflow vulnerability exists in 'kernel/bpf/devmap.c' when calculating hash bucket sizes for DEVMAP_HASH on 32-bit architectures. The 'roundup_pow_of_two' function can result in undefined behavior (UB) due to a 32-bit left-shift on an unsigned long when 'max_entries' exceeds 0x80000000. This bypasses existing overflow checks that only looked for a zero result after truncation. A local attacker can exploit this by creating a DEVMAP_HASH with a large 'max_entries' value, leading to a kernel crash (as demonstrated by syzbot on arm32) or potentially broader memory corruption. The fix moves the overflow check to occur before the rounding operation.

Affected products

  • Linux Linux Kernel 5.4 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-03-07: disclosed: Vulnerability reported and tested by syzbot
  • 2024-03-26: patched: Fix committed to various stable kernel branches
  • 2024-04-17: advisory: CVE-2024-26885 published

References

Related threats