CVE-2024-35917

{"id": "CVE-2024-35917", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-05-19T09:15:12.150", "references": [{"url": "https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c3062bdb859b6e2567e7f5c8cde20c0250bb130f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d3d74e45a060d218fe4b0c9174f0a77517509d8e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/c3062bdb859b6e2567e7f5c8cde20c0250bb130f", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/d3d74e45a060d218fe4b0c9174f0a77517509d8e", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Fix bpf_plt pointer arithmetic\n\nKui-Feng Lee reported a crash on s390x triggered by the\ndummy_st_ops/dummy_init_ptr_arg test [1]:\n\n [<0000000000000002>] 0x2\n [<00000000009d5cde>] bpf_struct_ops_test_run+0x156/0x250\n [<000000000033145a>] __sys_bpf+0xa1a/0xd00\n [<00000000003319dc>] __s390x_sys_bpf+0x44/0x50\n [<0000000000c4382c>] __do_syscall+0x244/0x300\n [<0000000000c59a40>] system_call+0x70/0x98\n\nThis is caused by GCC moving memcpy() after assignments in\nbpf_jit_plt(), resulting in NULL pointers being written instead of\nthe return and the target addresses.\n\nLooking at the GCC internals, the reordering is allowed because the\nalias analysis thinks that the memcpy() destination and the assignments'\nleft-hand-sides are based on different objects: new_plt and\nbpf_plt_ret/bpf_plt_target respectively, and therefore they cannot\nalias.\n\nThis is in turn due to a violation of the C standard:\n\n When two pointers are subtracted, both shall point to elements of the\n same array object, or one past the last element of the array object\n ...\n\nFrom the C's perspective, bpf_plt_ret and bpf_plt are distinct objects\nand cannot be subtracted. In the practical terms, doing so confuses the\nGCC's alias analysis.\n\nThe code was written this way in order to let the C side know a few\noffsets defined in the assembly. While nice, this is by no means\nnecessary. Fix the noncompliance by hardcoding these offsets.\n\n[1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/"}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: s390/bpf: Correcci\u00f3n de la aritm\u00e9tica del puntero bpf_plt Kui-Feng Lee inform\u00f3 un bloqueo en s390x provocado por la prueba dummy_st_ops/dummy_init_ptr_arg [1]: [&lt;00000000000000002&gt;] 0x2 [&lt;00000000009d5cde&gt; ] bpf_struct_ops_test_run+0x156/0x250 [&lt;000000000033145a&gt;] __sys_bpf+0xa1a/0xd00 [&lt;00000000003319dc&gt;] __s390x_sys_bpf+0x44/0x50 [&lt;0000000000 c4382c&gt;] __do_syscall+0x244/0x300 [&lt;0000000000c59a40&gt;] system_call+0x70/0x98 Esto es causado por GCC mueve memcpy() despu\u00e9s de las asignaciones en bpf_jit_plt(), lo que da como resultado que se escriban punteros NULL en lugar de las direcciones de retorno y de destino. Al observar los aspectos internos de GCC, se permite el reordenamiento porque el an\u00e1lisis de alias piensa que el destino memcpy() y los lados izquierdos de las asignaciones se basan en objetos diferentes: new_plt y bpf_plt_ret/bpf_plt_target respectivamente y, por lo tanto, no pueden crear alias. Esto, a su vez, se debe a una violaci\u00f3n del est\u00e1ndar C: cuando se restan dos punteros, ambos apuntar\u00e1n a elementos del mismo objeto de matriz, o uno m\u00e1s all\u00e1 del \u00faltimo elemento del objeto de matriz... Desde la perspectiva de C, bpf_plt_ret y bpf_plt son objetos distintos y no se pueden restar. En t\u00e9rminos pr\u00e1cticos, hacerlo confunde el an\u00e1lisis de alias del CCG. El c\u00f3digo se escribi\u00f3 de esta manera para que el lado C conozca algunas compensaciones definidas en el ensamblaje. Si bien es agradable, esto no es necesario. Corrija el incumplimiento codificando estas compensaciones. [1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/"}], "lastModified": "2025-09-23T15:26:14.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFE7A11E-CC1E-4B86-9E97-C1A6D0487D0E", "versionEndExcluding": "6.6.26", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DBD6C99E-4250-4DFE-8447-FF2075939D10", "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}