In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix hashtab overflow check on 32-bit arches
The hashtab code relies on rounduppowoftwo() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAPHASH type, which contains the same check, copied from the hashtab code. So apply the same fix to hashtab, by moving the overflow check to before the roundup.
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91117802748786422930496921659495940454",
"139377571946238704186482794102560403977",
"75626973608247816551589539435057372146",
"148411017022694297068086749833122478040",
"171681699082581783164753725525449060786",
"174727916363611350195397540435707367002",
"231326469744181617713639342250980973547",
"137826845975767081351435510683191303537",
"12788084662457735577200991171342647112"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b08cfc65f07b1132c1979d73f014ae6e04de55d",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"id": "CVE-2024-26884-1b80ee64"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2295.0,
"function_hash": "308976826100584881216075512540033218249"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92c81fbb3ed2e0dfc33a4183a67135e1ab566ace",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_map_alloc"
},
"id": "CVE-2024-26884-1d57a489"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2734.0,
"function_hash": "160770685762097452367542928323671486497"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a83fdaeaea3677b83a53f72ace2d73a19bcd6d93",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_map_alloc"
},
"id": "CVE-2024-26884-25d0f965"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91117802748786422930496921659495940454",
"139377571946238704186482794102560403977",
"75626973608247816551589539435057372146",
"148411017022694297068086749833122478040",
"171681699082581783164753725525449060786",
"174727916363611350195397540435707367002",
"231326469744181617713639342250980973547",
"186757356465303907379331878481063006216",
"282482875725139281345327854939815215301"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d817f0d34d927f2deb17dadbfe212c9a6a32ac3e",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"id": "CVE-2024-26884-38af8207"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2848.0,
"function_hash": "127241091580526729368731899282748915967"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8435f0961bf3dc65e204094349bd9aeaac1f8868",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_map_alloc"
},
"id": "CVE-2024-26884-4058fdf6"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2848.0,
"function_hash": "127241091580526729368731899282748915967"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d817f0d34d927f2deb17dadbfe212c9a6a32ac3e",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_map_alloc"
},
"id": "CVE-2024-26884-4827652d"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2276.0,
"function_hash": "165432072701387630788008251833235966929"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33ec04cadb77605b71d9298311919303d390c4d5",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_map_alloc"
},
"id": "CVE-2024-26884-4e5670ef"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2848.0,
"function_hash": "127241091580526729368731899282748915967"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6fa75b5096c0f9826a4fabe22d907b0a5bb1016",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_map_alloc"
},
"id": "CVE-2024-26884-6088eb98"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2848.0,
"function_hash": "127241091580526729368731899282748915967"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6787d916c2cf9850c97a0a3f73e08c43e7d973b1",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_map_alloc"
},
"id": "CVE-2024-26884-76f057b0"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91117802748786422930496921659495940454",
"139377571946238704186482794102560403977",
"75626973608247816551589539435057372146",
"148411017022694297068086749833122478040",
"171681699082581783164753725525449060786",
"174727916363611350195397540435707367002",
"231326469744181617713639342250980973547",
"137826845975767081351435510683191303537",
"12788084662457735577200991171342647112"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a83fdaeaea3677b83a53f72ace2d73a19bcd6d93",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"id": "CVE-2024-26884-78ed829b"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91117802748786422930496921659495940454",
"139377571946238704186482794102560403977",
"75626973608247816551589539435057372146",
"148411017022694297068086749833122478040",
"171681699082581783164753725525449060786",
"174727916363611350195397540435707367002",
"231326469744181617713639342250980973547",
"186757356465303907379331878481063006216",
"282482875725139281345327854939815215301"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8435f0961bf3dc65e204094349bd9aeaac1f8868",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"id": "CVE-2024-26884-8497ce9c"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91117802748786422930496921659495940454",
"139377571946238704186482794102560403977",
"75626973608247816551589539435057372146",
"148411017022694297068086749833122478040",
"171681699082581783164753725525449060786",
"174727916363611350195397540435707367002",
"231326469744181617713639342250980973547",
"186757356465303907379331878481063006216",
"282482875725139281345327854939815215301"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6787d916c2cf9850c97a0a3f73e08c43e7d973b1",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"id": "CVE-2024-26884-b9fbaba3"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91117802748786422930496921659495940454",
"139377571946238704186482794102560403977",
"75626973608247816551589539435057372146",
"148411017022694297068086749833122478040",
"171681699082581783164753725525449060786",
"174727916363611350195397540435707367002",
"231326469744181617713639342250980973547",
"128591580779532105342988084381909154933",
"228159563929742618362289963782036189601"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33ec04cadb77605b71d9298311919303d390c4d5",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"id": "CVE-2024-26884-be9964b7"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91117802748786422930496921659495940454",
"139377571946238704186482794102560403977",
"75626973608247816551589539435057372146",
"148411017022694297068086749833122478040",
"171681699082581783164753725525449060786",
"174727916363611350195397540435707367002",
"231326469744181617713639342250980973547",
"186757356465303907379331878481063006216",
"282482875725139281345327854939815215301"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6fa75b5096c0f9826a4fabe22d907b0a5bb1016",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"id": "CVE-2024-26884-c9fc3ea7"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91117802748786422930496921659495940454",
"139377571946238704186482794102560403977",
"75626973608247816551589539435057372146",
"148411017022694297068086749833122478040",
"171681699082581783164753725525449060786",
"174727916363611350195397540435707367002",
"231326469744181617713639342250980973547",
"128591580779532105342988084381909154933",
"228159563929742618362289963782036189601"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92c81fbb3ed2e0dfc33a4183a67135e1ab566ace",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"id": "CVE-2024-26884-e27bbaaf"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2153.0,
"function_hash": "110622115019832582094110499589378785430"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b08cfc65f07b1132c1979d73f014ae6e04de55d",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_map_alloc"
},
"id": "CVE-2024-26884-e633121d"
}
]