CVE-2024-35895

Description

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any interrupt context, locks taken during a map_delete_elem operation must be hardirq-safe. Otherwise a deadlock due to lock inversion is possible, as reported by lockdep: CPU0 CPU1 ---- ---- lock(&htab->buckets[i].lock); local_irq_disable(); lock(&host->lock); lock(&htab->buckets[i].lock); <Interrupt> lock(&host->lock); Locks in sockmap are hardirq-unsafe by design. We expects elements to be deleted from sockmap/sockhash only in task (normal) context with interrupts enabled, or in softirq context. Detect when map_delete_elem operation is invoked from a context which is _not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an error. Note that map updates are not affected by this issue. BPF verifier does not allow updating sockmap/sockhash from a BPF tracing program today.

Gravité et risque d'exploitation

CVE-2024-35895 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.18 %, ce qui la place devant 7.3 % des CVE référencées.

Que faire ?

• Vérifiez si Linux (versions 6.9, <=6.1.*, <668b3074aa14829e2ac2759799537a93b60fef86, 6.8.5, 4.20, 0, <f7990498b05ac41f7d6a190dc0418ef1d21bf058, <a44770fed86515eedb5a7c00b787f847ebb134a5, 6.6.26, 5.15.154, <4.20, <=5.10.*, <=6.6.*, 5.10.215, <ff91059932401894e6c86341915615c5eb0eca48, 604326b41a6fb9b4a78b6179335decee0365cd8c, <=5.4.*, 5.4.274, <=6.8.*, <d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec, 6.1.85, <=*, <=5.15.*, <dd54b48db0c822ae7b520bc80751f0a0a173ef75, <6af057ccdd8e7619960aca1f0428339f213b31cd) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://git.kernel.org/stable/c/f7990498b05ac41f7d6a190dc0418ef1d21bf058
• https://git.kernel.org/stable/c/dd54b48db0c822ae7b520bc80751f0a0a173ef75
• https://git.kernel.org/stable/c/d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec
• https://git.kernel.org/stable/c/a44770fed86515eedb5a7c00b787f847ebb134a5
• https://git.kernel.org/stable/c/668b3074aa14829e2ac2759799537a93b60fef86
• https://git.kernel.org/stable/c/6af057ccdd8e7619960aca1f0428339f213b31cd
• https://git.kernel.org/stable/c/ff91059932401894e6c86341915615c5eb0eca48