CVE-2024-53125 bpf: sync_linked_regs() must preserve subreg_def
A flaw in the Linux kernel BPF verifier allows incorrect code rewriting when specific flags are set, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53125?
CVE-2024-53125 is a high-severity vulnerability in Linux kernel, published on 4 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: sync_linked_regs() must preserve subreg_def
Range propagation must not affect subreg_def marks, otherwise the following example is rewritten by verifier incorrectly when BPF_F_TEST_RND_HI32 flag is set:
0: call bpf_ktime_get_ns call bpf_ktime_get_ns 1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff 2: w1 = w0 rewrites w1 = w0 3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r) 4: r1 >>= 32 r11 <<= 32 (r) 5: r0 = r1 r1 |= r11 (r) 6: exit; if w0 < 0xa goto pc+0 r1 >>= 32 r0 = r1 exit
(or zero extension of w1 at (2) is missing for architectures that require zero extension for upper register half).
The following happens w/o this patch: - r0 is marked as not a subreg at (0); - w1 is marked as subreg at (2); - w1 subreg_def is overridden at (3) by copy_register_state(); - w1 is read at (5) but mark_insn_zext() does not mark (2) for zero extension, because w1 subreg_def is not set; - because of BPF_F_TEST_RND_HI32 flag verifier inserts random value for hi32 bits of (2) (marked (r)); - this random value is read at (5).
Which versions are affected by CVE-2024-53125?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53125?
Apply the vendor's patch.
Is CVE-2024-53125 being exploited?
There is no known exploitation of CVE-2024-53125 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-53125, DEBIAN-CVE-2024-53125, GHSA-jgf3-fmmf-vj4h, UBUNTU-CVE-2024-53125.