In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Disallow vsyscall page read for copyfromkernel_nofault()
When trying to use copyfromkernel_nofault() to read vsyscall page through a bpf program, the following oops was reported:
BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 20390 Comm: testprogs ...... 6.7.0+ #58 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:copyfromkernelnofault+0x6f/0x110 ...... Call Trace: <TASK> ? copyfromkernelnofault+0x6f/0x110 bpfprobereadkernel+0x1d/0x50 bpfprog2061065e56845f08doproberead+0x51/0x8d tracecallbpf+0xc5/0x1c0 perfcallbpfenter.isra.0+0x69/0xb0 perfsyscallenter+0x13e/0x200 syscalltraceenter+0x188/0x1c0 dosyscall64+0xb5/0xe0 entrySYSCALL64after_hwframe+0x6e/0x76 </TASK> ...... ---[ end trace 0000000000000000 ]---
The oops is triggered when:
1) A bpf program uses bpfprobereadkernel() to read from the vsyscall page and invokes copyfromkernelnofault() which in turn calls _getuser_asm().
2) Because the vsyscall page address is not readable from kernel space, a page fault exception is triggered accordingly.
3) handlepagefault() considers the vsyscall page address as a user space address instead of a kernel space address. This results in the fix-up setup by bpf not being applied and a pagefaultoops() is invoked due to SMAP.
Considering handlepagefault() has already considered the vsyscall page address as a userspace address, fix the problem by disallowing vsyscall page read for copyfromkernel_nofault().
[
{
"digest": {
"length": 269.0,
"function_hash": "21873026763305686719564766690470419809"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f175de546a3eb77614d94d4c02550181c0a8493e",
"target": {
"function": "copy_from_kernel_nofault_allowed",
"file": "arch/x86/mm/maccess.c"
},
"id": "CVE-2024-26906-0f408fd1",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"129913928517765379213656687464600801355",
"223197325436998419714795630709767145332",
"65868403604527011038302402244248744202",
"205860952757494951020283619424133438717",
"114493110673184929618565502470266495020"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f175de546a3eb77614d94d4c02550181c0a8493e",
"target": {
"file": "arch/x86/mm/maccess.c"
},
"id": "CVE-2024-26906-1d231454",
"signature_type": "Line"
},
{
"digest": {
"length": 269.0,
"function_hash": "21873026763305686719564766690470419809"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29bd6f86904682adafe9affbc7f79b14defcaff8",
"target": {
"function": "copy_from_kernel_nofault_allowed",
"file": "arch/x86/mm/maccess.c"
},
"id": "CVE-2024-26906-2a593a82",
"signature_type": "Function"
},
{
"digest": {
"length": 269.0,
"function_hash": "21873026763305686719564766690470419809"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57f78c46f08198e1be08ffe99c4c1ccc12855bf5",
"target": {
"function": "copy_from_kernel_nofault_allowed",
"file": "arch/x86/mm/maccess.c"
},
"id": "CVE-2024-26906-4745ca38",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"129913928517765379213656687464600801355",
"223197325436998419714795630709767145332",
"65868403604527011038302402244248744202",
"205860952757494951020283619424133438717",
"114493110673184929618565502470266495020"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57f78c46f08198e1be08ffe99c4c1ccc12855bf5",
"target": {
"file": "arch/x86/mm/maccess.c"
},
"id": "CVE-2024-26906-b3818d0c",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"129913928517765379213656687464600801355",
"223197325436998419714795630709767145332",
"65868403604527011038302402244248744202",
"205860952757494951020283619424133438717",
"114493110673184929618565502470266495020"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8a67fe34b76a49320b33032228a794f40b0316b",
"target": {
"file": "arch/x86/mm/maccess.c"
},
"id": "CVE-2024-26906-b7736d49",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"129913928517765379213656687464600801355",
"223197325436998419714795630709767145332",
"65868403604527011038302402244248744202",
"205860952757494951020283619424133438717",
"114493110673184929618565502470266495020"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29bd6f86904682adafe9affbc7f79b14defcaff8",
"target": {
"file": "arch/x86/mm/maccess.c"
},
"id": "CVE-2024-26906-d610a429",
"signature_type": "Line"
},
{
"digest": {
"length": 269.0,
"function_hash": "21873026763305686719564766690470419809"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8a67fe34b76a49320b33032228a794f40b0316b",
"target": {
"function": "copy_from_kernel_nofault_allowed",
"file": "arch/x86/mm/maccess.c"
},
"id": "CVE-2024-26906-f7d9a3e2",
"signature_type": "Function"
}
]