CVE-2024-56675

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56675
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF program to a uprobe, and non-sleepable BPF programs are freed via normal RCU (see __bpf_prog_put_noref()). This leads to UAF of the bpf_prog because a normal RCU grace period does not imply a tasks-trace-RCU grace period. Fix it by explicitly waiting for a tasks-trace-RCU grace period after removing the attachment of a bpf_prog to a perf_event.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/9245459a992d22fe0e92e988f49db1fec82c184a Patch
https://git.kernel.org/stable/c/9b53d2c2a38a1effc341d99be3f99fa7ef17047d Patch
https://git.kernel.org/stable/c/ef1b808e3b7c98612feceedf985c2fbbeb28f956 Patch
https://git.kernel.org/stable/c/f9f85df30118f3f4112761e6682fc60ebcce23e5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
History

06 Jan 2025, 15:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/9245459a992d22fe0e92e988f49db1fec82c184a - () https://git.kernel.org/stable/c/9245459a992d22fe0e92e988f49db1fec82c184a - Patch
References () https://git.kernel.org/stable/c/9b53d2c2a38a1effc341d99be3f99fa7ef17047d - () https://git.kernel.org/stable/c/9b53d2c2a38a1effc341d99be3f99fa7ef17047d - Patch
References () https://git.kernel.org/stable/c/ef1b808e3b7c98612feceedf985c2fbbeb28f956 - () https://git.kernel.org/stable/c/ef1b808e3b7c98612feceedf985c2fbbeb28f956 - Patch
References () https://git.kernel.org/stable/c/f9f85df30118f3f4112761e6682fc60ebcce23e5 - () https://git.kernel.org/stable/c/f9f85df30118f3f4112761e6682fc60ebcce23e5 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Arreglar UAF a través de la falta de coincidencia de los sabores de RCU de bpf_prog/attachment Los uprobes siempre usan bpf_prog_run_array_uprobe() bajo la protección de tareas-trace-RCU. Pero es posible adjuntar un programa BPF no durmiente a un uprobe, y los programas BPF no durmientes se liberan a través de RCU normal (ver __bpf_prog_put_noref()). Esto lleva a UAF de bpf_prog porque un período de gracia de RCU normal no implica un período de gracia de tareas-trace-RCU. Arréglelo esperando explícitamente un período de gracia de tareas-trace-RCU después de eliminar la conexión de un bpf_prog a un perf_event.
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

27 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 15:15

Updated : 2025-02-10 18:15

NVD link : CVE-2024-56675

Mitre link : CVE-2024-56675

CVE.ORG link : CVE-2024-56675

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free