CVE-2024-35917

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-35917
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35917.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-35917
Downstream
Related
Published
2024-05-19T08:35:09Z
Modified
2025-10-09T08:51:12.264831Z
Summary
s390/bpf: Fix bpf_plt pointer arithmetic
Details

In the Linux kernel, the following vulnerability has been resolved:

s390/bpf: Fix bpf_plt pointer arithmetic

Kui-Feng Lee reported a crash on s390x triggered by the dummystops/dummyinitptr_arg test [1]:

[<0000000000000002>] 0x2 [<00000000009d5cde>] bpfstructopstestrun+0x156/0x250 [<000000000033145a>] _sysbpf+0xa1a/0xd00 [<00000000003319dc>] _s390xsysbpf+0x44/0x50 [<0000000000c4382c>] _dosyscall+0x244/0x300 [<0000000000c59a40>] systemcall+0x70/0x98

This is caused by GCC moving memcpy() after assignments in bpfjitplt(), resulting in NULL pointers being written instead of the return and the target addresses.

Looking at the GCC internals, the reordering is allowed because the alias analysis thinks that the memcpy() destination and the assignments' left-hand-sides are based on different objects: newplt and bpfpltret/bpfplt_target respectively, and therefore they cannot alias.

This is in turn due to a violation of the C standard:

When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object ...

From the C's perspective, bpfpltret and bpf_plt are distinct objects and cannot be subtracted. In the practical terms, doing so confuses the GCC's alias analysis.

The code was written this way in order to let the C side know a few offsets defined in the assembly. While nice, this is by no means necessary. Fix the noncompliance by hardcoding these offsets.

[1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f1d5df84cd8c3ec6460c78f5b86be7c84577a83f
Fixed
c3062bdb859b6e2567e7f5c8cde20c0250bb130f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f1d5df84cd8c3ec6460c78f5b86be7c84577a83f
Fixed
d3d74e45a060d218fe4b0c9174f0a77517509d8e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f1d5df84cd8c3ec6460c78f5b86be7c84577a83f
Fixed
7ded842b356d151ece8ac4985940438e6d3998bb

Affected versions

v6.*

v6.2
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.8.1
v6.8.2
v6.8.3
v6.8.4

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.3.0
Fixed
6.6.26
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.8.5