cbcvebase.
CVE-2024-41009
published 2024-07-17

CVE-2024-41009: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented…

PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.26%
17.5th percentile
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumer_pos is the consumer counter to show which logical position the consumer consumed the data, and producer_pos which is the producer counter denoting the amount of data reserved by all producers. Each time a record is reserved, the producer that "owns" the record will successfully advance producer counter. In user space each time a record is read, the consumer of the data advanced the consumer counter once it finished processing. Both counters are stored in separate pages so that from user space, the producer counter is read-only and the consumer counter is read-write. One aspect that simplifies and thus speeds up the implementation of both producers and consumers is how the data area is mapped twice contiguously back-to-back in the virtual memory, allowing to not take any special measures for samples that have to wrap around at the end of the circular buffer data area, because the next page after the last data page would be first data page again, and thus the sample will still appear completely contiguous in virtual memory. Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header for book-keeping the length and offset, and is inaccessible to the BPF program. Helpers like bpf_ringbuf_reserve() return `(void *)hdr + BPF_RINGBUF_HDR_SZ` for the BPF program to use. Bing-Jhong and Muhammad reported that it is however possible to make a second allocated memory chunk overlapping with the first chunk and as a result, the BPF program is now able to edit first chunk's header. For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with size of 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call to bpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in [0x0,0x3008]

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.98-1 (bookworm)linux 6.1.98-1 (bookworm)
debianlinux-6.1< linux 6.1.98-1 (bookworm)linux 6.1.98-1 (bookworm)
linuxlinux——
linuxlinux>= 457f44363a8894135c85b7a9afd2bd8196db24ab < be35504b959f2749bab280f4671e8df96dcf836fbe35504b959f2749bab280f4671e8df96dcf836f
linuxlinux>= 457f44363a8894135c85b7a9afd2bd8196db24ab < 0f98f40eb1ed52af8b81f61901b6c0289ff59de40f98f40eb1ed52af8b81f61901b6c0289ff59de4
linuxlinux>= 457f44363a8894135c85b7a9afd2bd8196db24ab < d1b9df0435bc61e0b44f578846516df8ef476686d1b9df0435bc61e0b44f578846516df8ef476686
linuxlinux>= 457f44363a8894135c85b7a9afd2bd8196db24ab < 511804ab701c0503b72eac08217eabfd366ba069511804ab701c0503b72eac08217eabfd366ba069
linuxlinux>= 457f44363a8894135c85b7a9afd2bd8196db24ab < 47416c852f2a04d348ea66ee451cbdcf8119f22547416c852f2a04d348ea66ee451cbdcf8119f225
linuxlinux>= 457f44363a8894135c85b7a9afd2bd8196db24ab < cfa1a2329a691ffd991fcf7248a57d752e712881cfa1a2329a691ffd991fcf7248a57d752e712881
linuxlinux_kernel>= 0 < 5.10.223-15.10.223-1
linuxlinux_kernel>= 0 < 6.1.98-16.1.98-1
linuxlinux_kernel>= 0 < 6.9.8-16.9.8-1
linuxlinux_kernel>= 0 < 6.9.8-16.9.8-1
linuxlinux_kernel>= 0 < 5.15.0-122.1325.15.0-122.132
linuxlinux_kernel>= 0 < 6.8.0-45.456.8.0-45.45
linuxlinux_kernel>= 5.8 < 6.1.976.1.97
linuxlinux_kernel>= 6.2 < 6.6.376.6.37
linuxlinux_kernel>= 6.7 < 6.9.86.9.8
msrcazl3_kernel_6.6.35.1-5_on_azure_linux_3.0——
msrcazl3_kernel_6.6.43.1-7_on_azure_linux_3.0——
msrccbl2_kernel_5.15.164.1-1_on_cbl_mariner_2.0——
msrccbl2_kernel_5.15.182.1-1_on_cbl_mariner_2.0——

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.