CVE-2024-38662 bpf: Allow delete from sockmap/sockhash only if update is allowed
A missing authorization check in the Linux kernel BPF subsystem allows unauthorized deletion from sockmap/sockhash, potentially leading to privilege escalation or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38662?
CVE-2024-38662 is a medium-severity missing authorization vulnerability in Linux kernel, published on 21 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Allow delete from sockmap/sockhash only if update is allowed
We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash.
We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map.
From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types.
Which versions are affected by CVE-2024-38662?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-38662?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-38662 being exploited?
There is no known exploitation of CVE-2024-38662 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-42842, AZL-42847, BELL-CVE-2024-38662, DEBIAN-CVE-2024-38662, GHSA-pj9w-f8jv-85cc, UBUNTU-CVE-2024-38662.