cve-2024-35917
Vulnerability from cvelistv5
Published
2024-05-19 08:35
Modified
2024-08-02 03:21
Severity
Summary
s390/bpf: Fix bpf_plt pointer arithmetic
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c3062bdb859b6e2567e7f5c8cde20c0250bb130f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d3d74e45a060d218fe4b0c9174f0a77517509d8e
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35917",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:38:36.152025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:41:11.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.000Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c3062bdb859b6e2567e7f5c8cde20c0250bb130f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d3d74e45a060d218fe4b0c9174f0a77517509d8e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c3062bdb859b",
              "status": "affected",
              "version": "f1d5df84cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "d3d74e45a060",
              "status": "affected",
              "version": "f1d5df84cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "7ded842b356d",
              "status": "affected",
              "version": "f1d5df84cd8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Fix bpf_plt pointer arithmetic\n\nKui-Feng Lee reported a crash on s390x triggered by the\ndummy_st_ops/dummy_init_ptr_arg test [1]:\n\n  [\u003c0000000000000002\u003e] 0x2\n  [\u003c00000000009d5cde\u003e] bpf_struct_ops_test_run+0x156/0x250\n  [\u003c000000000033145a\u003e] __sys_bpf+0xa1a/0xd00\n  [\u003c00000000003319dc\u003e] __s390x_sys_bpf+0x44/0x50\n  [\u003c0000000000c4382c\u003e] __do_syscall+0x244/0x300\n  [\u003c0000000000c59a40\u003e] system_call+0x70/0x98\n\nThis is caused by GCC moving memcpy() after assignments in\nbpf_jit_plt(), resulting in NULL pointers being written instead of\nthe return and the target addresses.\n\nLooking at the GCC internals, the reordering is allowed because the\nalias analysis thinks that the memcpy() destination and the assignments\u0027\nleft-hand-sides are based on different objects: new_plt and\nbpf_plt_ret/bpf_plt_target respectively, and therefore they cannot\nalias.\n\nThis is in turn due to a violation of the C standard:\n\n  When two pointers are subtracted, both shall point to elements of the\n  same array object, or one past the last element of the array object\n  ...\n\nFrom the C\u0027s perspective, bpf_plt_ret and bpf_plt are distinct objects\nand cannot be subtracted. In the practical terms, doing so confuses the\nGCC\u0027s alias analysis.\n\nThe code was written this way in order to let the C side know a few\noffsets defined in the assembly. While nice, this is by no means\nnecessary. Fix the noncompliance by hardcoding these offsets.\n\n[1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:31:13.689Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c3062bdb859b6e2567e7f5c8cde20c0250bb130f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3d74e45a060d218fe4b0c9174f0a77517509d8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb"
        }
      ],
      "title": "s390/bpf: Fix bpf_plt pointer arithmetic",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35917",
    "datePublished": "2024-05-19T08:35:09.932Z",
    "dateReserved": "2024-05-17T13:50:33.123Z",
    "dateUpdated": "2024-08-02T03:21:49.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35917\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:12.150\",\"lastModified\":\"2024-05-20T13:00:04.957\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/bpf: Fix bpf_plt pointer arithmetic\\n\\nKui-Feng Lee reported a crash on s390x triggered by the\\ndummy_st_ops/dummy_init_ptr_arg test [1]:\\n\\n  [\u003c0000000000000002\u003e] 0x2\\n  [\u003c00000000009d5cde\u003e] bpf_struct_ops_test_run+0x156/0x250\\n  [\u003c000000000033145a\u003e] __sys_bpf+0xa1a/0xd00\\n  [\u003c00000000003319dc\u003e] __s390x_sys_bpf+0x44/0x50\\n  [\u003c0000000000c4382c\u003e] __do_syscall+0x244/0x300\\n  [\u003c0000000000c59a40\u003e] system_call+0x70/0x98\\n\\nThis is caused by GCC moving memcpy() after assignments in\\nbpf_jit_plt(), resulting in NULL pointers being written instead of\\nthe return and the target addresses.\\n\\nLooking at the GCC internals, the reordering is allowed because the\\nalias analysis thinks that the memcpy() destination and the assignments\u0027\\nleft-hand-sides are based on different objects: new_plt and\\nbpf_plt_ret/bpf_plt_target respectively, and therefore they cannot\\nalias.\\n\\nThis is in turn due to a violation of the C standard:\\n\\n  When two pointers are subtracted, both shall point to elements of the\\n  same array object, or one past the last element of the array object\\n  ...\\n\\nFrom the C\u0027s perspective, bpf_plt_ret and bpf_plt are distinct objects\\nand cannot be subtracted. In the practical terms, doing so confuses the\\nGCC\u0027s alias analysis.\\n\\nThe code was written this way in order to let the C side know a few\\noffsets defined in the assembly. While nice, this is by no means\\nnecessary. Fix the noncompliance by hardcoding these offsets.\\n\\n[1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: s390/bpf: Correcci\u00f3n de la aritm\u00e9tica del puntero bpf_plt Kui-Feng Lee inform\u00f3 un bloqueo en s390x provocado por la prueba dummy_st_ops/dummy_init_ptr_arg [1]: [\u0026lt;00000000000000002\u0026gt;] 0x2 [\u0026lt;00000000009d5cde\u0026gt; ] bpf_struct_ops_test_run+0x156/0x250 [\u0026lt;000000000033145a\u0026gt;] __sys_bpf+0xa1a/0xd00 [\u0026lt;00000000003319dc\u0026gt;] __s390x_sys_bpf+0x44/0x50 [\u0026lt;0000000000 c4382c\u0026gt;] __do_syscall+0x244/0x300 [\u0026lt;0000000000c59a40\u0026gt;] system_call+0x70/0x98 Esto es causado por GCC mueve memcpy() despu\u00e9s de las asignaciones en bpf_jit_plt(), lo que da como resultado que se escriban punteros NULL en lugar de las direcciones de retorno y de destino. Al observar los aspectos internos de GCC, se permite el reordenamiento porque el an\u00e1lisis de alias piensa que el destino memcpy() y los lados izquierdos de las asignaciones se basan en objetos diferentes: new_plt y bpf_plt_ret/bpf_plt_target respectivamente y, por lo tanto, no pueden crear alias. Esto, a su vez, se debe a una violaci\u00f3n del est\u00e1ndar C: cuando se restan dos punteros, ambos apuntar\u00e1n a elementos del mismo objeto de matriz, o uno m\u00e1s all\u00e1 del \u00faltimo elemento del objeto de matriz... Desde la perspectiva de C, bpf_plt_ret y bpf_plt son objetos distintos y no se pueden restar. En t\u00e9rminos pr\u00e1cticos, hacerlo confunde el an\u00e1lisis de alias del CCG. El c\u00f3digo se escribi\u00f3 de esta manera para que el lado C conozca algunas compensaciones definidas en el ensamblaje. Si bien es agradable, esto no es necesario. Corrija el incumplimiento codificando estas compensaciones. [1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c3062bdb859b6e2567e7f5c8cde20c0250bb130f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d3d74e45a060d218fe4b0c9174f0a77517509d8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.