linux-cve-announce - CVE-2024-42161: bpf: Avoid uninitialized value in BPF_CORE_READ

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024073036-CVE-2024-42161-7104@gregkh>
Date: Tue, 30 Jul 2024 09:48:19 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-42161: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD

[Changes from V1:
 - Use a default branch in the switch statement to initialize `val'.]

GCC warns that `val' may be used uninitialized in the
BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as:

	[...]
	unsigned long long val;						      \
	[...]								      \
	switch (__CORE_RELO(s, field, BYTE_SIZE)) {			      \
	case 1: val = *(const unsigned char *)p; break;			      \
	case 2: val = *(const unsigned short *)p; break;		      \
	case 4: val = *(const unsigned int *)p; break;			      \
	case 8: val = *(const unsigned long long *)p; break;		      \
        }       							      \
	[...]
	val;								      \
	}								      \

This patch adds a default entry in the switch statement that sets
`val' to zero in order to avoid the warning, and random values to be
used in case __builtin_preserve_field_info returns unexpected values
for BPF_FIELD_BYTE_SIZE.

Tested in bpf-next master.
No regressions.

The Linux kernel CVE team has assigned CVE-2024-42161 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.222 with commit b694989bb13e
	Fixed in 5.15.163 with commit 3364c2ed1c24
	Fixed in 6.1.98 with commit a21d76bd0b0d
	Fixed in 6.6.39 with commit 7e5471b5efeb
	Fixed in 6.9.9 with commit ff941a8449e7
	Fixed in 6.10 with commit 009367099eb6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-42161
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	tools/lib/bpf/bpf_core_read.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b694989bb13ed5f166e633faa1eb0f21c6d261a6
	https://git.kernel.org/stable/c/3364c2ed1c241989847f19cf83e3db903ce689e3
	https://git.kernel.org/stable/c/a21d76bd0b0d39518e9a4c19f6cf7c042a974aff
	https://git.kernel.org/stable/c/7e5471b5efebc30dd0bc035cda86693a5c73d45f
	https://git.kernel.org/stable/c/ff941a8449e712eaf7efca1a13bfb9afd3d99fc2
	https://git.kernel.org/stable/c/009367099eb61a4fc2af44d4eb06b6b4de7de6db