CVE-2024-26591 bpf: Fix re-attachment branch in bpf_tracing_prog_attach
A null pointer dereference in the Linux kernel BPF subsystem allows local attackers to cause a system crash via specific program attachment sequences.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26591?
CVE-2024-26591 is a medium-severity vulnerability in Linux kernel, published on 22 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix re-attachment branch in bpf_tracing_prog_attach
The following case can cause a crash due to missing attach_btf:
1) load rawtp program 2) load fentry program with rawtp as target_fd 3) create tracing link for fentry program with target_fd = 0 4) repeat 3
In the end we have:
- prog->aux->dst_trampoline == NULL - tgt_prog == NULL (because we did not provide target_fd to link_create) - prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X) - the program was loaded for tgt_prog but we have no way to find out which one
BUG: kernel NULL pointer dereference, address: 0000000000000058 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15b/0x430 ? fixup_exception+0x22/0x330 ? exc_page_fault+0x6f/0x170 ? asm_exc_page_fault+0x22/0x30 ? bpf_tracing_prog_attach+0x279/0x560 ? btf_obj_id+0x5/0x10 bpf_tracing_prog_attach+0x439/0x560 __sys_bpf+0x1cf4/0x2de0 __x64_sys_bpf+0x1c/0x30 do_syscall_64+0x41/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76
Return -EINVAL in this situation.
Weakness: CWE-476
Which versions are affected by CVE-2024-26591?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26591?
Apply the vendor's patch.
Is CVE-2024-26591 being exploited?
There is no known exploitation of CVE-2024-26591 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26591, DEBIAN-CVE-2024-26591, GHSA-x2wh-v69v-x2w9, UBUNTU-CVE-2024-26591.