Junglewise Threat Intelligence

CVE-2024-38662: Linux Kernel locking violation in BPF sockmap deletion

CVE-2024-38662 · Severity: medium · CVSS 4.7 · Published 2024-06-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem could allow a local attacker to trigger a system instability or locking violation. The issue occurs when certain types of BPF programs, which are used for high-performance networking and system monitoring, perform unauthorized deletion operations on internal socket maps. This could lead to a denial of service or unexpected system behavior in specific configurations.

Technical details

A vulnerability exists in the Linux kernel BPF verifier where it fails to enforce the same program-type restrictions for 'map_delete' operations as it does for 'map_update' operations on sockmap and sockhash structures. Specifically, BPF programs attached to tracepoints could trigger locking rule violations (potential deadlocks or memory corruption) by performing a 'map_delete_elem' call. The fix extends the 'may_update_sockmap' check in 'kernel/bpf/verifier.c' to also cover deletion operations, ensuring only authorized program types can modify these maps. This is a local attack requiring the ability to load BPF programs.

Affected products

  • Linux Linux Kernel 5.10 to 5.10.219, 5.15 to 5.15.161, 6.1 to 6.1.93, 6.6 to 6.6.33, 6.9 to 6.9.4

Timeline

  • 2024-06-21: disclosed: Initial disclosure of the vulnerability and fix in the Linux kernel.
  • 2024-06-21: advisory: NVD published the CVE record.

References

Related threats