Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()

set_memory_rox() can fail, leaving memory unprotected.

Check return and bail out when bpf_jit_binary_lock_ro() returns
an error.

========Wind River Notice========
Mitigation:
The default Wind River Linux kernel does NOT prevent eBPF to be used. Customers can use kernel.unprivileged_bpf_disabled sysctl to prevent unprivileged users from being able to use eBPF.

This CVE would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For WRlinux to confirm the current state, inspect the sysctl with the command:

cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

CVEs

• CVE-2024-42067