In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix address emission with tag-based KASAN enabled
When BPFTRAMPFCALLORIG is enabled, the address of a bpftrampimage struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emita64movi64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpftramp_image address emission.
[
{
"id": "CVE-2024-50203-0b9fef37",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"digest": {
"line_hashes": [
"92730425698253146170915017261773898734",
"233947004790491792703469403691172457266",
"10158309967207794041303450698520006198",
"9874028718814083288523850603273074407",
"131543011702253304070151822692195772266",
"115413492295234077345256900511426725581",
"203673559605599025527224245725009538904",
"29149688508482266949824041496421325833"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e80f366ebfdfafc685fe83a84c34f7ef01cbe88"
},
{
"id": "CVE-2024-50203-0d6def78",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"digest": {
"line_hashes": [
"92730425698253146170915017261773898734",
"233947004790491792703469403691172457266",
"10158309967207794041303450698520006198",
"9874028718814083288523850603273074407",
"42075082832664007975853707995794465377",
"306319758629857562874898294237919596208",
"60101581294193617032304284554732167689",
"29149688508482266949824041496421325833"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7db1a2121f3c7903b8e397392beec563c3d00950"
},
{
"id": "CVE-2024-50203-11401a8f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "prepare_trampoline"
},
"digest": {
"function_hash": "33458110477786438730932189407110569019",
"length": 4140.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f521c2a0c0c4585f36d912bf62c852b88682c4f2"
},
{
"id": "CVE-2024-50203-310c7a29",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"digest": {
"line_hashes": [
"92730425698253146170915017261773898734",
"233947004790491792703469403691172457266",
"10158309967207794041303450698520006198",
"9874028718814083288523850603273074407",
"131543011702253304070151822692195772266",
"115413492295234077345256900511426725581",
"203673559605599025527224245725009538904",
"29149688508482266949824041496421325833"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f521c2a0c0c4585f36d912bf62c852b88682c4f2"
},
{
"id": "CVE-2024-50203-442a0604",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "prepare_trampoline"
},
"digest": {
"function_hash": "287597028904908131395907487726818666054",
"length": 3886.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7db1a2121f3c7903b8e397392beec563c3d00950"
},
{
"id": "CVE-2024-50203-5c4304bc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "prepare_trampoline"
},
"digest": {
"function_hash": "287597028904908131395907487726818666054",
"length": 3886.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c"
},
{
"id": "CVE-2024-50203-93954832",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "prepare_trampoline"
},
"digest": {
"function_hash": "33458110477786438730932189407110569019",
"length": 4140.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e80f366ebfdfafc685fe83a84c34f7ef01cbe88"
},
{
"id": "CVE-2024-50203-c3b9cffe",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"digest": {
"line_hashes": [
"92730425698253146170915017261773898734",
"233947004790491792703469403691172457266",
"10158309967207794041303450698520006198",
"9874028718814083288523850603273074407",
"42075082832664007975853707995794465377",
"306319758629857562874898294237919596208",
"60101581294193617032304284554732167689",
"29149688508482266949824041496421325833"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c"
}
]