Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: track changes_pkt_data property for global functions

When processing calls to certain helpers, verifier invalidates all
packet pointers in a current state. For example, consider the
following program:

_{_}attribute{_}{_}(({_}{_}noinline{_}_))
long skb_pull_data(struct __sk_buff *sk, __u32 len)

{ return bpf_skb_pull_data(sk, len); }

SEC("tc")
int test_invalidate_checks(struct __sk_buff *sk)

{ int *p = (void *)(long)sk->data; if ((void *)(p + 1) > (void *)(long)sk->data_end) return TCX_DROP; skb_pull_data(sk, 0); *p = 42; return TCX_PASS; }

After a call to bpf_skb_pull_data() the pointer 'p' can't be used
safely. See function filter.c:bpf_helper_changes_pkt_data() for a list
of such helpers.

At the moment verifier invalidates packet pointers when processing
helper function calls, and does not traverse global sub-programs when
processing calls to global sub-programs. This means that calls to
helpers done from global sub-programs do not invalidate pointers in
the caller state. E.g. the program above is unsafe, but is not
rejected by verifier.

This commit fixes the omission by computing field
bpf_subprog_info->changes_pkt_data for each sub-program before main
verification pass.
changes_pkt_data should be set if:
 - subprogram calls helper for which bpf_helper_changes_pkt_data
returns true;
 - subprogram calls a global function,
for which bpf_subprog_info->changes_pkt_data should be set.

The verifier.c:check_cfg() pass is modified to compute this
information. The commit relies on depth first instruction traversal
done by check_cfg() and absence of recursive function calls:
 - check_cfg() would eventually visit every call to subprogram S in a
state when S is fully explored;
 - when S is fully explored:
 - every direct helper call within S is explored
(and thus changes_pkt_data is set if needed);
 - every call to subprogram S1 called by S was visited with S1 fully
explored (and thus S inherits changes_pkt_data from S1).

The downside of such approach is that dead code elimination is not
taken into account: if a helper call inside global function is dead
because of current configuration, verifier would conservatively assume
that the call occurs for the purpose of the changes_pkt_data
computation.

 

 

========Wind River Notice========

It cannot backport directly due to context gap, the context changed represents a substantial amount of BPF subsystem evolution  that would be risky to backport as it could introduce regressions or compatibility issues.

 

*Mitigation:*

The default WindRiver Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the WindRiver Linux to confirm the current state, inspect the sysctl with the command:

cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

CVEs

• CVE-2024-58098