CVE-2024-58237

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58237
In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers. Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected: int tail_call(struct __sk_buff *sk) { bpf_tail_call_static(sk, &jmp_table, 0); return 0; } SEC("tc") int not_safe(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; ... make p valid ... tail_call(sk); *p = 42; /* this is unsafe */ ... } The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that can invalidate packet pointers. Otherwise, it can't be freplaced with tailcall_freplace.c:entry_freplace() that does a tail call.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70 Patch
https://git.kernel.org/stable/c/1c2244437f9ad3dd91215f920401a14f2542dbfc Patch
https://git.kernel.org/stable/c/f1692ee23dcaaddc24ba407b269707ee5df1301f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
History

10 Nov 2025, 17:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70 - () https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70 - Patch
References () https://git.kernel.org/stable/c/1c2244437f9ad3dd91215f920401a14f2542dbfc - () https://git.kernel.org/stable/c/1c2244437f9ad3dd91215f920401a14f2542dbfc - Patch
References () https://git.kernel.org/stable/c/f1692ee23dcaaddc24ba407b269707ee5df1301f - () https://git.kernel.org/stable/c/f1692ee23dcaaddc24ba407b269707ee5df1301f - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

09 May 2025, 08:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/f1692ee23dcaaddc24ba407b269707ee5df1301f -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: considerar que las llamadas de cola invalidan los punteros de paquete. Los programas con llamadas de cola podrían ejecutar cualquiera de los ayudantes que invalidan los punteros de paquete. Por lo tanto, se asume, de forma conservadora, que cada llamada de cola invalida los punteros de paquete. Al realizar el cambio en bpf_helper_changes_pkt_data(), se utiliza automáticamente la lógica check_cfg(), que calcula el efecto de 'changes_pkt_data' para los subprogramas globales, de modo que el siguiente programa podría ser rechazado: int tail_call(struct __sk_buff *sk) { bpf_tail_call_static(sk, &jmp_table, 0); return 0; } SEC("tc") int not_safe(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; ... make p valid ... tail_call(sk); *p = 42; /* esto no es seguro */ ... } La función tc_bpf2bpf.c:subprog_tc() debe modificarse: márquela como una función que puede invalidar punteros de paquetes. De lo contrario, no se puede reemplazar con tailcall_freplace.c:entry_freplace(), que realiza una llamada de cola.

05 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-05 15:15

Updated : 2025-11-10 17:35

NVD link : CVE-2024-58237

Mitre link : CVE-2024-58237

CVE.ORG link : CVE-2024-58237

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference