In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stackmap overflow check on 32-bit arches
The stackmap code relies on rounduppowoftwo() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAPHASH type, which contains the same check, copied from the hashtab code.
The commit in the fixes tag actually attempted to fix this, but the fix did not account for the UB, so the fix only works on CPUs where an overflow does result in a neat truncation to zero, which is not guaranteed. Checking the value before rounding does not have this problem.
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0e214acc59145ce25113f617311aa79dda39cb3",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"244482780670543041472561281932248281248",
"296616919218921721583998582912015778591"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-2e0f60ea"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43f798b9036491fb014b55dd61c4c5c3193267d0",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"220340885302989452344954597667785054791",
"68199290088205821012467352746995347123"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-37b70984"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21e5fa4688e1a4d3db6b72216231b24232f75c1d",
"digest": {
"length": 1465.0,
"function_hash": "253802593598699332430425152575311799117"
},
"id": "CVE-2024-26883-4d7dd2fd"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43f798b9036491fb014b55dd61c4c5c3193267d0",
"digest": {
"length": 1135.0,
"function_hash": "206252651664544221043151072684255276934"
},
"id": "CVE-2024-26883-61fc1930"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a4b21250bf79eef26543d35bd390448646c536b",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"220340885302989452344954597667785054791",
"68199290088205821012467352746995347123"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-6ef6a3e8"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f06899582ccee09bd85d0696290e3eaca9aa042d",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"220340885302989452344954597667785054791",
"68199290088205821012467352746995347123"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-7237172d"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0971126c8164abe2004b8536b49690a0d6005b0a",
"digest": {
"length": 1135.0,
"function_hash": "206252651664544221043151072684255276934"
},
"id": "CVE-2024-26883-7257c6cd"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a4b21250bf79eef26543d35bd390448646c536b",
"digest": {
"length": 1135.0,
"function_hash": "206252651664544221043151072684255276934"
},
"id": "CVE-2024-26883-7abdbcb1"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7070b274c7866a4c5036f8d54fcaf315c64ac33a",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"220340885302989452344954597667785054791",
"68199290088205821012467352746995347123"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-7e65b810"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15641007df0f0d35fa28742b25c2a7db9dcd6895",
"digest": {
"length": 1451.0,
"function_hash": "330904129815452273052704324833260799936"
},
"id": "CVE-2024-26883-9a94230d"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21e5fa4688e1a4d3db6b72216231b24232f75c1d",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"142178833875010712449081617984726529426",
"232009772136495680327198507418184591593"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-cbc607ae"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15641007df0f0d35fa28742b25c2a7db9dcd6895",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"142178833875010712449081617984726529426",
"232009772136495680327198507418184591593"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-cfc081f9"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7070b274c7866a4c5036f8d54fcaf315c64ac33a",
"digest": {
"length": 1135.0,
"function_hash": "206252651664544221043151072684255276934"
},
"id": "CVE-2024-26883-d9023515"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f06899582ccee09bd85d0696290e3eaca9aa042d",
"digest": {
"length": 1187.0,
"function_hash": "135718240940142710368707033905800883321"
},
"id": "CVE-2024-26883-d92c6100"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca1f06e72dec41ae4f76e7b1a8a97265447b46ae",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"220340885302989452344954597667785054791",
"68199290088205821012467352746995347123"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-da309884"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0971126c8164abe2004b8536b49690a0d6005b0a",
"digest": {
"line_hashes": [
"148986723547937969733230739154871962493",
"267926693097181916638075318304847319969",
"9178725648871930604000099690181462202",
"25860520194647091165149265347775303760",
"220340885302989452344954597667785054791",
"68199290088205821012467352746995347123"
],
"threshold": 0.9
},
"id": "CVE-2024-26883-e39abf91"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0e214acc59145ce25113f617311aa79dda39cb3",
"digest": {
"length": 1533.0,
"function_hash": "274123139231310417794632549725928279789"
},
"id": "CVE-2024-26883-ecd912f3"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/bpf/stackmap.c",
"function": "stack_map_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca1f06e72dec41ae4f76e7b1a8a97265447b46ae",
"digest": {
"length": 1212.0,
"function_hash": "13095845805076936557032083150954241997"
},
"id": "CVE-2024-26883-fb0c47b3"
}
]