CVE-2024-49850 bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
A local attacker can cause a kernel crash by loading a BPF program with malformed relocation records, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49850?
CVE-2024-49850 is a medium-severity vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
In case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCAL referencing a non-existing BTF type, function bpf_core_calc_relo_insn would cause a null pointer deference.
Fix this by adding a proper check upper in call stack, as malformed relocation records could be passed from user space.
Simplest reproducer is a program:
r0 = 0 exit
With a single relocation record:
.insn_off = 0, /* patch first instruction */ .type_id = 100500, /* this type id does not exist */ .access_str_off = 6, /* offset of string "0" */ .kind = BPF_CORE_TYPE_ID_LOCAL,
See the link for original reproducer or next commit for a test case.
Weakness: CWE-476
Which versions are affected by CVE-2024-49850?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-49850?
Apply the vendor's patch.
Is CVE-2024-49850 being exploited?
There is no known exploitation of CVE-2024-49850 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-50665, BELL-CVE-2024-49850, DEBIAN-CVE-2024-49850, GHSA-qvf9-958h-6h8p, UBUNTU-CVE-2024-49850.