Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:bpf: Fix a sdiv overflow issueZac Ecob reported a problem where a bpf program may cause kernel crash dueto the follo
wing error:  Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTIThe failure is due to the below signed divide:  LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808.LLONG
_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808,but it is impossible since for 64-bit system, the maximum positivenumber is 9,223,372,036,854,775,807. On x86_6
4, LLONG_MIN/-1 willcause a kernel exception. On arm64, the result for LLONG_MIN/-1 isLLONG_MIN.Further investigation found all the following sdiv/smod cases may triggeran exception w
hen bpf program is running on x86_64 platform:  - LLONG_MIN/-1 for 64bit operation  - INT_MIN/-1 for 32bit operation  - LLONG_MIN%-1 for 64bit operation  - INT_MIN%-1 for 32bit operat
ionwhere -1 can be an immediate or in a register.On arm64, there are no exceptions:  - LLONG_MIN/-1 = LLONG_MIN  - INT_MIN/-1 = INT_MIN  - LLONG_MIN%-1 = 0  - INT_MIN%-1 = 0where -1 c
an be an immediate or in a register.Insn patching is needed to handle the above cases and the patched codesproduced results aligned with above arm64 result. The below are pseudocodes 
to handle sdiv/smod exceptions including both divisor -1 and divisor 0and the divisor is stored in a register.sdiv:      tmp = rX      tmp += 1 /* [-1, 0] -> [0, 1]      if tmp >(unsi
gned) 1 goto L2      if tmp == 0 goto L1      rY = 0  L1:      rY = -rY;      goto L3  L2:      rY /= rX  L3:smod:      tmp = rX      tmp += 1 /* [-1, 0] -> [0, 1]      if tmp >(unsig
ned) 1 goto L1      if tmp == 1 (is64 ? goto L2 : goto L3)      rY = 0;      goto L2  L1:      rY %= rX  L2:      goto L4  // only when !is64  L3:      wY = wY  // only when !is64  L4
:  [1] https://lore.kernel.org/bpf/tPJLTEh7S_DxFEqAI2Ji5MBSoZVg7_G-Py2iaZpAaWtM961fFTWtsnlzwvTbzBzaUzwQAoNATXKUlt0LZOFgnDcIyKCswAnAGdUF3LBrhGQ=@protonmail.com/

========Wind River Notice========
Mitigation:

Customers can use kernel.unprivileged_bpf_disabled sysctl to prevent unprivileged users from being able to use eBPF. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.
 
Inspect kernel.unprivileged_bpf_disabled sysctl with the command:
    

cat /proc/sys/kernel/unprivileged_bpf_disabled


The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.
    

echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled


For more details, please refer to Linux kernel official document:
https://docs.kernel.org/admin-guide/sysctl/kernel.html#unprivileged-bpf-disabled

CVEs

• CVE-2024-49888