In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Disallow vsyscall page read for copyfromkernel_nofault()
When trying to use copyfromkernel_nofault() to read vsyscall page through a bpf program, the following oops was reported:
BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 20390 Comm: testprogs ...... 6.7.0+ #58 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:copyfromkernelnofault+0x6f/0x110 ...... Call Trace: <TASK> ? copyfromkernelnofault+0x6f/0x110 bpfprobereadkernel+0x1d/0x50 bpfprog2061065e56845f08doproberead+0x51/0x8d tracecallbpf+0xc5/0x1c0 perfcallbpfenter.isra.0+0x69/0xb0 perfsyscallenter+0x13e/0x200 syscalltraceenter+0x188/0x1c0 dosyscall64+0xb5/0xe0 entrySYSCALL64after_hwframe+0x6e/0x76 </TASK> ...... ---[ end trace 0000000000000000 ]---
The oops is triggered when:
1) A bpf program uses bpfprobereadkernel() to read from the vsyscall page and invokes copyfromkernelnofault() which in turn calls _getuser_asm().
2) Because the vsyscall page address is not readable from kernel space, a page fault exception is triggered accordingly.
3) handlepagefault() considers the vsyscall page address as a user space address instead of a kernel space address. This results in the fix-up setup by bpf not being applied and a pagefaultoops() is invoked due to SMAP.
Considering handlepagefault() has already considered the vsyscall page address as a userspace address, fix the problem by disallowing vsyscall page read for copyfromkernel_nofault().
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f175de546a3eb77614d94d4c02550181c0a8493e", "target": { "function": "copy_from_kernel_nofault_allowed", "file": "arch/x86/mm/maccess.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-0f408fd1", "digest": { "function_hash": "21873026763305686719564766690470419809", "length": 269.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e4694e65b6db4c3de125115dd4f55848cc48381", "target": { "function": "copy_from_kernel_nofault_allowed", "file": "arch/x86/mm/maccess.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-1c0d250f", "digest": { "function_hash": "21873026763305686719564766690470419809", "length": 269.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f175de546a3eb77614d94d4c02550181c0a8493e", "target": { "file": "arch/x86/mm/maccess.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-1d231454", "digest": { "line_hashes": [ "129913928517765379213656687464600801355", "223197325436998419714795630709767145332", "65868403604527011038302402244248744202", "205860952757494951020283619424133438717", "114493110673184929618565502470266495020" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29bd6f86904682adafe9affbc7f79b14defcaff8", "target": { "function": "copy_from_kernel_nofault_allowed", "file": "arch/x86/mm/maccess.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-2a593a82", "digest": { "function_hash": "21873026763305686719564766690470419809", "length": 269.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57f78c46f08198e1be08ffe99c4c1ccc12855bf5", "target": { "function": "copy_from_kernel_nofault_allowed", "file": "arch/x86/mm/maccess.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-4745ca38", "digest": { "function_hash": "21873026763305686719564766690470419809", "length": 269.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58", "target": { "function": "copy_from_kernel_nofault_allowed", "file": "arch/x86/mm/maccess.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-5234f9a0", "digest": { "function_hash": "21873026763305686719564766690470419809", "length": 269.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58", "target": { "file": "arch/x86/mm/maccess.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-9499134b", "digest": { "line_hashes": [ "129913928517765379213656687464600801355", "223197325436998419714795630709767145332", "65868403604527011038302402244248744202", "205860952757494951020283619424133438717", "114493110673184929618565502470266495020" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e4694e65b6db4c3de125115dd4f55848cc48381", "target": { "file": "arch/x86/mm/maccess.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-97537293", "digest": { "line_hashes": [ "129913928517765379213656687464600801355", "223197325436998419714795630709767145332", "65868403604527011038302402244248744202", "205860952757494951020283619424133438717", "114493110673184929618565502470266495020" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57f78c46f08198e1be08ffe99c4c1ccc12855bf5", "target": { "file": "arch/x86/mm/maccess.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-b3818d0c", "digest": { "line_hashes": [ "129913928517765379213656687464600801355", "223197325436998419714795630709767145332", "65868403604527011038302402244248744202", "205860952757494951020283619424133438717", "114493110673184929618565502470266495020" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8a67fe34b76a49320b33032228a794f40b0316b", "target": { "file": "arch/x86/mm/maccess.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-b7736d49", "digest": { "line_hashes": [ "129913928517765379213656687464600801355", "223197325436998419714795630709767145332", "65868403604527011038302402244248744202", "205860952757494951020283619424133438717", "114493110673184929618565502470266495020" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29bd6f86904682adafe9affbc7f79b14defcaff8", "target": { "file": "arch/x86/mm/maccess.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-d610a429", "digest": { "line_hashes": [ "129913928517765379213656687464600801355", "223197325436998419714795630709767145332", "65868403604527011038302402244248744202", "205860952757494951020283619424133438717", "114493110673184929618565502470266495020" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8a67fe34b76a49320b33032228a794f40b0316b", "target": { "function": "copy_from_kernel_nofault_allowed", "file": "arch/x86/mm/maccess.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2024-26906-f7d9a3e2", "digest": { "function_hash": "21873026763305686719564766690470419809", "length": 269.0 } } ]