CVE-2024-56675: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF via mismatching bpfprog/attachment RCU flavors
Uprobes always use bpfprogrunarrayuprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF program to a uprobe, and non-sleepable BPF programs are freed via normal RCU (see bpfprogputnoref()). This leads to UAF of the bpfprog because a normal RCU grace period does not imply a tasks-trace-RCU grace period.
Fix it by explicitly waiting for a tasks-trace-RCU grace period after removing the attachment of a bpfprog to a perfevent.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
After removing the attachment of a bpf_prog to a perf_event (involving uprobe attachment removal), explicitly wait for a tasks-trace-RCU grace period before completing cleanup, since a normal RCU grace period does not imply a tasks-trace-RCU grace period.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56675?
CVE-2024-56675 is considered to have a moderate severity impact due to potential use-after-free vulnerabilities in the Linux kernel.
How do I fix CVE-2024-56675?
To fix CVE-2024-56675, update the Linux kernel to the latest patched version that resolves the vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-56675?
CVE-2024-56675 affects Linux kernel versions from 6.0 up to and including 6.1.121, 6.2 to 6.6.67, and 6.7 up to 6.12.6.
What does CVE-2024-56675 impact in the Linux kernel?
CVE-2024-56675 impacts the BPF (Berkeley Packet Filter) system, specifically related to uprobes and improper attachment of BPF programs.
Is there a workaround for CVE-2024-56675 if I cannot update the kernel?
There are no widely recommended workarounds for CVE-2024-56675, and updating is the best solution to mitigate the vulnerability.