CVE-2024-50163 bpf: Make sure internal and UAPI bpf_redirect flags don't overlap
A flag overlap in the Linux kernel BPF subsystem causes a crash when mixing SKB and XDP redirect paths, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50163?
CVE-2024-50163 is a medium-severity vulnerability in Linux kernel, published on 7 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Make sure internal and UAPI bpf_redirect flags don't overlap
The bpf_redirect_info is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri->flags field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that if skb bpf_redirect_neigh() is used with a non-NULL params argument and, subsequently, an XDP redirect is performed using the same bpf_redirect_info struct, the XDP path will get confused and end up crashing, which syzbot managed to trigger.
With the stack-allocated bpf_redirect_info, the structure is no longer shared between the SKB and XDP paths, so the crash doesn't happen anymore. However, different code paths using identically-numbered flag values in the same struct field still seems like a bit of a mess, so this patch cleans that up by moving the flag definitions together and redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make sure the overlap is not re-introduced by mistake.
Which versions are affected by CVE-2024-50163?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50163?
Apply the vendor's patch.
Is CVE-2024-50163 being exploited?
There is no known exploitation of CVE-2024-50163 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-53444, AZL-53694, BELL-CVE-2024-50163, DEBIAN-CVE-2024-50163, GHSA-f6cq-3vq2-5393, UBUNTU-CVE-2024-50163.