In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
The devmap code allocates a number hash buckets equal to the next power of two of the max_entries value provided when creating the map. When rounding up to the next power of two, the 32-bit variable storing the number of buckets can overflow, and the code checks for overflow by checking if the truncated 32-bit value is equal to 0. However, on 32-bit arches the rounding up itself can overflow mid-way through, because it ends up doing a left-shift of 32 bits on an unsigned long value. If the size of an unsigned long is four bytes, this is undefined behaviour, so there is no guarantee that we'll end up with a nice and tidy 0-value at the end.
Syzbot managed to turn this into a crash on arm32 by creating a DEVMAPHASH with maxentries > 0x80000000 and then trying to update it. Fix this by moving the overflow check to before the rounding up operation.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@250051acc21f9d4c5c595e4fcb55986ea08c4691",
"id": "CVE-2024-26885-30a0d7da",
"target": {
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166719571128444513069350240202794522300",
"270849065070595273761526074726255539240",
"329252410264687014371855507513207933049",
"181911919866239492221563191125520354695",
"95068239672157150899962448052650698935",
"192927008276846266456671453026770760964",
"96615348498134752172717316355592484818",
"49105446240403549608882014602456914011"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22079b3a423382335f47d9ed32114e6c9fe88d7c",
"id": "CVE-2024-26885-415be450",
"target": {
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166719571128444513069350240202794522300",
"270849065070595273761526074726255539240",
"329252410264687014371855507513207933049",
"181911919866239492221563191125520354695",
"95068239672157150899962448052650698935",
"192927008276846266456671453026770760964",
"96615348498134752172717316355592484818",
"49105446240403549608882014602456914011"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e89386f62ce9a9ab9a94835a9890883c23d9d52c",
"id": "CVE-2024-26885-46b443ef",
"target": {
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166719571128444513069350240202794522300",
"270849065070595273761526074726255539240",
"329252410264687014371855507513207933049",
"181911919866239492221563191125520354695",
"95068239672157150899962448052650698935",
"192927008276846266456671453026770760964",
"96615348498134752172717316355592484818",
"49105446240403549608882014602456914011"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@281d464a34f540de166cee74b723e97ac2515ec3",
"id": "CVE-2024-26885-6a47592e",
"target": {
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166719571128444513069350240202794522300",
"270849065070595273761526074726255539240",
"329252410264687014371855507513207933049",
"181911919866239492221563191125520354695",
"95068239672157150899962448052650698935",
"192927008276846266456671453026770760964",
"96615348498134752172717316355592484818",
"49105446240403549608882014602456914011"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e89386f62ce9a9ab9a94835a9890883c23d9d52c",
"id": "CVE-2024-26885-70d3854a",
"target": {
"function": "dev_map_init_map",
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"length": 1009.0,
"function_hash": "142870472882876500749209354867635907583"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c826502bed93970f2fd488918a7b8d5f1d30e2e3",
"id": "CVE-2024-26885-8c334dd2",
"target": {
"function": "dev_map_init_map",
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"length": 1009.0,
"function_hash": "142870472882876500749209354867635907583"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22079b3a423382335f47d9ed32114e6c9fe88d7c",
"id": "CVE-2024-26885-8f9543ae",
"target": {
"function": "dev_map_init_map",
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"length": 1009.0,
"function_hash": "142870472882876500749209354867635907583"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edf7990baa48de5097daa9ac02e06cb4c798a737",
"id": "CVE-2024-26885-ad1cb60e",
"target": {
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166719571128444513069350240202794522300",
"270849065070595273761526074726255539240",
"329252410264687014371855507513207933049",
"181911919866239492221563191125520354695",
"95068239672157150899962448052650698935",
"192927008276846266456671453026770760964",
"96615348498134752172717316355592484818",
"49105446240403549608882014602456914011"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b81a9f92b3676cb74b907a7a209b3d15bd9a7f9",
"id": "CVE-2024-26885-b0fc386c",
"target": {
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166719571128444513069350240202794522300",
"270849065070595273761526074726255539240",
"329252410264687014371855507513207933049",
"161963493049991531385840643250178848024",
"109222101253280219913349217656573655280",
"305569307006527418741555507186626911860"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f5e352b9088211fa5eb4e1639cd365f4f7d2f65",
"id": "CVE-2024-26885-c0b86e22",
"target": {
"function": "dev_map_init_map",
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"length": 1468.0,
"function_hash": "59939515319234800873851519424565519954"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@281d464a34f540de166cee74b723e97ac2515ec3",
"id": "CVE-2024-26885-dd3691dd",
"target": {
"function": "dev_map_init_map",
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"length": 1009.0,
"function_hash": "142870472882876500749209354867635907583"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edf7990baa48de5097daa9ac02e06cb4c798a737",
"id": "CVE-2024-26885-e3d85ac5",
"target": {
"function": "dev_map_init_map",
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"length": 1009.0,
"function_hash": "142870472882876500749209354867635907583"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c826502bed93970f2fd488918a7b8d5f1d30e2e3",
"id": "CVE-2024-26885-e83aa0ca",
"target": {
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166719571128444513069350240202794522300",
"270849065070595273761526074726255539240",
"329252410264687014371855507513207933049",
"181911919866239492221563191125520354695",
"95068239672157150899962448052650698935",
"192927008276846266456671453026770760964",
"96615348498134752172717316355592484818",
"49105446240403549608882014602456914011"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b81a9f92b3676cb74b907a7a209b3d15bd9a7f9",
"id": "CVE-2024-26885-eef31efc",
"target": {
"function": "dev_map_init_map",
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"length": 1323.0,
"function_hash": "134182142701648799497670186854387473839"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@250051acc21f9d4c5c595e4fcb55986ea08c4691",
"id": "CVE-2024-26885-f1ae1115",
"target": {
"function": "dev_map_init_map",
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"length": 1009.0,
"function_hash": "142870472882876500749209354867635907583"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f5e352b9088211fa5eb4e1639cd365f4f7d2f65",
"id": "CVE-2024-26885-f265eaa1",
"target": {
"file": "kernel/bpf/devmap.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"56776674822641678886726182322069318856",
"71952724600685758049269055229383911799",
"329252410264687014371855507513207933049",
"161963493049991531385840643250178848024",
"109222101253280219913349217656573655280",
"305569307006527418741555507186626911860"
]
},
"signature_type": "Line"
}
]