ghsa-hr4c-2jrx-4v7g
Vulnerability from github
Published
2024-03-03 00:30
Modified
2024-03-03 00:30
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Annotate bpf_long_memcpy with data_race

syzbot reported a data race splat between two processes trying to update the same BPF map value via syscall on different CPUs:

BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update

write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd

write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x0000000000000000 -> 0xfffffff000002788

The bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size and forced to use long read/writes to try to atomically copy long counters. It is best-effort only and no barriers are here since it will race with concurrent updates from BPF programs. The bpf_long_memcpy() is called from bpf(2) syscall. Marco suggested that the best way to make this known to KCSAN would be to use data_race() annotation.

Show details on source website


{
  "affected": [],
  "aliases": [
    "CVE-2023-52521"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-02T22:15:48Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Annotate bpf_long_memcpy with data_race\n\nsyzbot reported a data race splat between two processes trying to\nupdate the same BPF map value via syscall on different CPUs:\n\n  BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update\n\n  write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1:\n   bpf_long_memcpy include/linux/bpf.h:428 [inline]\n   bpf_obj_memcpy include/linux/bpf.h:441 [inline]\n   copy_map_value_long include/linux/bpf.h:464 [inline]\n   bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380\n   bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175\n   generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749\n   bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648\n   __sys_bpf+0x28a/0x780\n   __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]\n   __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]\n   __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239\n   do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n   do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n   entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n  write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0:\n   bpf_long_memcpy include/linux/bpf.h:428 [inline]\n   bpf_obj_memcpy include/linux/bpf.h:441 [inline]\n   copy_map_value_long include/linux/bpf.h:464 [inline]\n   bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380\n   bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175\n   generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749\n   bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648\n   __sys_bpf+0x28a/0x780\n   __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]\n   __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]\n   __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239\n   do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n   do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n   entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n  value changed: 0x0000000000000000 -\u003e 0xfffffff000002788\n\nThe bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size\nand forced to use long read/writes to try to atomically copy long counters.\nIt is best-effort only and no barriers are here since it _will_ race with\nconcurrent updates from BPF programs. The bpf_long_memcpy() is called from\nbpf(2) syscall. Marco suggested that the best way to make this known to\nKCSAN would be to use data_race() annotation.",
  "id": "GHSA-hr4c-2jrx-4v7g",
  "modified": "2024-03-03T00:30:32Z",
  "published": "2024-03-03T00:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52521"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5685f8a6fae1fbe480493b980a1fdbe67c86a094"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6a86b5b5cd76d2734304a0173f5f01aa8aa2025e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e562de67dc9196f2415f117796a2108c00ac7fc6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading...

Loading...

Loading...
  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.