CVE-2024-38662

We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash.

We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map.

From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

dd54b48db0c822ae7b520bc80751f0a0a173ef75

Fixed

29467edc23818dc5a33042ffb4920b49b090e63d

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec

Fixed

11e8ecc5b86037fec43d07b1c162e233e131b1d9

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

a44770fed86515eedb5a7c00b787f847ebb134a5

Fixed

6693b172f008846811f48a099f33effc26068e1e

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

668b3074aa14829e2ac2759799537a93b60fef86

Fixed

000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

ff91059932401894e6c86341915615c5eb0eca48

Fixed

b81e1c5a3c70398cf76631ede63a03616ed1ba3c

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

ff91059932401894e6c86341915615c5eb0eca48

Fixed

98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

f7990498b05ac41f7d6a190dc0418ef1d21bf058

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6af057ccdd8e7619960aca1f0428339f213b31cd

Affected versions

v5.*

v5.10.1

v5.10.10

v5.10.11

v5.10.12

v5.10.13

v5.10.14

v5.10.15

v5.10.16

v5.10.17

v5.10.18

v5.10.19

v5.10.2

v5.10.215

v5.10.216

v5.10.217

v5.10.218

v5.10.3

v5.10.4

v5.10.5

v5.10.6

v5.10.7

v5.10.8

v5.10.9

v5.11.1

v5.11.10

v5.11.11

v5.11.12

v5.11.13

v5.11.14

v5.11.15

v5.11.16

v5.11.17

v5.11.18

v5.11.19

v5.11.2

v5.11.20

v5.11.21

v5.11.3

v5.11.4

v5.11.5

v5.11.6

v5.11.7

v5.11.8

v5.11.9

v5.12.1

v5.12.10

v5.12.11

v5.12.12

v5.12.13

v5.12.14

v5.12.15

v5.12.16

v5.12.17

v5.12.18

v5.12.19

v5.12.2

v5.12.3

v5.12.4

v5.12.5

v5.12.6

v5.12.7

v5.12.8

v5.12.9

v5.13.1

v5.13.10

v5.13.11

v5.13.12

v5.13.13

v5.13.14

v5.13.15

v5.13.16

v5.13.17

v5.13.18

v5.13.2

v5.13.3

v5.13.4

v5.13.5

v5.13.6

v5.13.7

v5.13.8

v5.13.9

v5.14.1

v5.14.10

v5.14.11

v5.14.12

v5.14.13

v5.14.14

v5.14.15

v5.14.16

v5.14.17

v5.14.18

v5.14.19

v5.14.2

v5.14.20

v5.14.3

v5.14.4

v5.14.5

v5.14.6

v5.14.7

v5.14.8

v5.14.9

v5.15.1

v5.15.10

v5.15.11

v5.15.12

v5.15.13

v5.15.14

v5.15.15

v5.15.154

v5.15.155

v5.15.156

v5.15.157

v5.15.158

v5.15.159

v5.15.16

v5.15.160

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.3

v5.15.4

v5.15.5

v5.15.6

v5.15.7

v5.15.8

v5.15.9

v5.16.1

v5.16.10

v5.16.11

v5.16.12

v5.16.13

v5.16.14

v5.16.15

v5.16.16

v5.16.17

v5.16.18

v5.16.19

v5.16.2

v5.16.20

v5.16.3

v5.16.4

v5.16.5

v5.16.6

v5.16.7

v5.16.8

v5.16.9

v5.17.1

v5.17.10

v5.17.11

v5.17.12

v5.17.13

v5.17.14

v5.17.2

v5.17.3

v5.17.4

v5.17.5

v5.17.6

v5.17.7

v5.17.8

v5.17.9

v5.18.1

v5.18.10

v5.18.11

v5.18.12

v5.18.13

v5.18.14

v5.18.15

v5.18.16

v5.18.17

v5.18.18

v5.18.19

v5.18.2

v5.18.3

v5.18.4

v5.18.5

v5.18.6

v5.18.7

v5.18.8

v5.18.9

v5.19.1

v5.19.10

v5.19.11

v5.19.12

v5.19.13

v5.19.14

v5.19.15

v5.19.16

v5.19.2

v5.19.3

v5.19.4

v5.19.5

v5.19.6

v5.19.7

v5.19.8

v5.19.9

v5.4.274

v5.4.275

v5.4.276

v5.4.277

v5.4.278

v5.4.279

v5.4.280

v5.4.281

v5.4.282

v5.4.283

v5.4.284

v5.4.285

v5.4.286

v5.4.287

v5.4.288

v5.4.289

v5.4.290

v5.4.291

v5.4.292

v5.4.293

v5.4.294

v5.4.295

v5.4.296

v5.4.297

v5.4.298

v5.4.299

v5.4.300

v5.6.1

v5.6.10

v5.6.11

v5.6.12

v5.6.13

v5.6.14

v5.6.15

v5.6.16

v5.6.17

v5.6.18

v5.6.2

v5.6.3

v5.6.4

v5.6.5

v5.6.6

v5.6.7

v5.6.8

v5.6.9

v5.7.1

v5.7.10

v5.7.11

v5.7.12

v5.7.13

v5.7.14

v5.7.15

v5.7.16

v5.7.2

v5.7.3

v5.7.4

v5.7.5

v5.7.6

v5.7.7

v5.7.8

v5.7.9

v5.8.1

v5.8.10

v5.8.11

v5.8.12

v5.8.13

v5.8.14

v5.8.15

v5.8.16

v5.8.17

v5.8.18

v5.8.2

v5.8.3

v5.8.4

v5.8.5

v5.8.6

v5.8.7

v5.8.8

v5.8.9

v5.9.1

v5.9.10

v5.9.11

v5.9.12

v5.9.13

v5.9.14

v5.9.15

v5.9.16

v5.9.2

v5.9.3

v5.9.4

v5.9.5

v5.9.6

v5.9.7

v5.9.8

v5.9.9

v6.*

v6.0.1

v6.0.10

v6.0.11

v6.0.12

v6.0.13

v6.0.14

v6.0.15

v6.0.16

v6.0.17

v6.0.18

v6.0.2

v6.0.3

v6.0.4

v6.0.5

v6.0.6

v6.0.7

v6.0.8

v6.0.9

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.2

v6.1.3

v6.1.4

v6.1.5

v6.1.6

v6.1.7

v6.1.8

v6.1.85

v6.1.86

v6.1.87

v6.1.88

v6.1.89

v6.1.9

v6.1.90

v6.1.91

v6.1.92

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.10.1

v6.10.10

v6.10.11

v6.10.12

v6.10.13

v6.10.2

v6.10.3

v6.10.4

v6.10.5

v6.10.6

v6.10.7

v6.10.8

v6.10.9

v6.11

v6.11-rc1

v6.11-rc2

v6.11-rc3

v6.11-rc4

v6.11-rc5

v6.11-rc6

v6.11-rc7

v6.11.1

v6.11.10

v6.11.11

v6.11.2

v6.11.3

v6.11.4

v6.11.5

v6.11.6

v6.11.7

v6.11.8

v6.11.9

v6.12

v6.12-rc1

v6.12-rc2

v6.12-rc3

v6.12-rc4

v6.12-rc5

v6.12-rc6

v6.12-rc7

v6.12.1

v6.12.10

v6.12.11

v6.12.12

v6.12.13

v6.12.14

v6.12.2

v6.12.3

v6.12.4

v6.12.5

v6.12.6

v6.12.7

v6.12.8

v6.12.9

v6.13

v6.13-rc1

v6.13-rc2

v6.13-rc3

v6.13-rc4

v6.13-rc5

v6.13-rc6

v6.13-rc7

v6.13.1

v6.13.10

v6.13.11

v6.13.12

v6.13.2

v6.13.3

v6.13.4

v6.13.5

v6.13.6

v6.13.7

v6.13.8

v6.13.9

v6.14

v6.14-rc1

v6.14-rc2

v6.14-rc3

v6.14-rc4

v6.14-rc5

v6.14-rc6

v6.14-rc7

v6.14.1

v6.14.10

v6.14.11

v6.14.2

v6.14.3

v6.14.4

v6.14.5

v6.14.6

v6.14.7

v6.14.8

v6.14.9

v6.15

v6.15-rc1

v6.15-rc2

v6.15-rc3

v6.15-rc4

v6.15-rc5

v6.15-rc6

v6.15-rc7

v6.15.1

v6.15.10

v6.15.11

v6.15.2

v6.15.3

v6.15.4

v6.15.5

v6.15.6

v6.15.7

v6.15.8

v6.15.9

v6.16

v6.16-rc1

v6.16-rc2

v6.16-rc3

v6.16-rc4

v6.16-rc5

v6.16-rc6

v6.16-rc7

v6.16.1

v6.16.10

v6.16.11

v6.16.12

v6.16.2

v6.16.3

v6.16.4

v6.16.5

v6.16.6

v6.16.7

v6.16.8

v6.16.9

v6.17

v6.17-rc1

v6.17-rc2

v6.17-rc3

v6.17-rc4

v6.17-rc5

v6.17-rc6

v6.17-rc7

v6.17.1

v6.17.2

v6.17.3

v6.2.1

v6.2.10

v6.2.11

v6.2.12

v6.2.13

v6.2.14

v6.2.15

v6.2.2

v6.2.3

v6.2.4

v6.2.5

v6.2.6

v6.2.7

v6.2.8

v6.2.9

v6.3.1

v6.3.10

v6.3.11

v6.3.12

v6.3.2

v6.3.3

v6.3.4

v6.3.5

v6.3.6

v6.3.7

v6.3.8

v6.3.9

v6.4.1

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

v6.4.15

v6.4.16

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v6.5.1

v6.5.10

v6.5.11

v6.5.12

v6.5.13

v6.5.2

v6.5.3

v6.5.4

v6.5.5

v6.5.6

v6.5.7

v6.5.8

v6.5.9

v6.6.1

v6.6.10

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.2

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.3

v6.6.30

v6.6.31

v6.6.32

v6.6.4

v6.6.5

v6.6.6

v6.6.7

v6.6.8

v6.6.9

v6.7.1

v6.7.10

v6.7.11

v6.7.2

v6.7.3

v6.7.4

v6.7.5

v6.7.6

v6.7.7

v6.7.8

v6.7.9

v6.8.10

v6.8.11

v6.8.12

v6.8.5

v6.8.6

v6.8.7

v6.8.8

v6.8.9

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

v6.9.1

v6.9.10

v6.9.11

v6.9.12

v6.9.2

v6.9.3

v6.9.4

v6.9.5

v6.9.6

v6.9.7

v6.9.8

v6.9.9

Database specific

{
    "vanir_signatures": [
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "may_update_sockmap"
            },
            "signature_version": "v1",
            "digest": {
                "length": 640.0,
                "function_hash": "158408658421488995327054741383336107750"
            },
            "id": "CVE-2024-38662-17cb795b",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1"
        },
        {
            "deprecated": false,
            "signature_type": "Line",
            "target": {
                "file": "kernel/bpf/verifier.c"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "7951363273844158997269440188261648089",
                    "278923824943629224052149208149839493838",
                    "95024830595712549718239881963116039460",
                    "67241830700915376453166430681788109394",
                    "287825870037365048958949144350964352837",
                    "297215249275033344689269068849347888893",
                    "43592083409730823798475229206434858833",
                    "50817482264475870619502068663446896134",
                    "219598259301048817366013311300163617023",
                    "229525884466669471377673659781293511242",
                    "229670240702912403965929939914899539282",
                    "43599723422404838837931357381598305072",
                    "21681151911229597155917282065768200766",
                    "100513450600306280933628058840708700840",
                    "286851154665423463784781304584671457844",
                    "138213226128574572427451668061370308842"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-38662-1fb3f770",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1"
        },
        {
            "deprecated": false,
            "signature_type": "Line",
            "target": {
                "file": "kernel/bpf/verifier.c"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "7951363273844158997269440188261648089",
                    "278923824943629224052149208149839493838",
                    "95024830595712549718239881963116039460",
                    "67241830700915376453166430681788109394",
                    "287825870037365048958949144350964352837",
                    "297215249275033344689269068849347888893",
                    "43592083409730823798475229206434858833",
                    "50817482264475870619502068663446896134",
                    "219598259301048817366013311300163617023",
                    "229525884466669471377673659781293511242",
                    "229670240702912403965929939914899539282",
                    "43599723422404838837931357381598305072",
                    "21681151911229597155917282065768200766",
                    "100513450600306280933628058840708700840",
                    "286851154665423463784781304584671457844",
                    "138213226128574572427451668061370308842"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-38662-239a3812",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29467edc23818dc5a33042ffb4920b49b090e63d"
        },
        {
            "deprecated": false,
            "signature_type": "Line",
            "target": {
                "file": "kernel/bpf/verifier.c"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "7951363273844158997269440188261648089",
                    "278923824943629224052149208149839493838",
                    "95024830595712549718239881963116039460",
                    "67241830700915376453166430681788109394",
                    "287825870037365048958949144350964352837",
                    "297215249275033344689269068849347888893",
                    "43592083409730823798475229206434858833",
                    "50817482264475870619502068663446896134",
                    "219598259301048817366013311300163617023",
                    "229525884466669471377673659781293511242",
                    "229670240702912403965929939914899539282",
                    "43599723422404838837931357381598305072",
                    "21681151911229597155917282065768200766",
                    "100513450600306280933628058840708700840",
                    "286851154665423463784781304584671457844",
                    "138213226128574572427451668061370308842"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-38662-51b9f031",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81e1c5a3c70398cf76631ede63a03616ed1ba3c"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "may_update_sockmap"
            },
            "signature_version": "v1",
            "digest": {
                "length": 640.0,
                "function_hash": "158408658421488995327054741383336107750"
            },
            "id": "CVE-2024-38662-54268728",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11e8ecc5b86037fec43d07b1c162e233e131b1d9"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "check_map_func_compatibility"
            },
            "signature_version": "v1",
            "digest": {
                "length": 5533.0,
                "function_hash": "18012636801240852651590815529866444910"
            },
            "id": "CVE-2024-38662-5b55b793",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11e8ecc5b86037fec43d07b1c162e233e131b1d9"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "may_update_sockmap"
            },
            "signature_version": "v1",
            "digest": {
                "length": 640.0,
                "function_hash": "158408658421488995327054741383336107750"
            },
            "id": "CVE-2024-38662-666feb2e",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6693b172f008846811f48a099f33effc26068e1e"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "check_map_func_compatibility"
            },
            "signature_version": "v1",
            "digest": {
                "length": 6898.0,
                "function_hash": "130769171752625465129146301446658396910"
            },
            "id": "CVE-2024-38662-85af3fa0",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1"
        },
        {
            "deprecated": false,
            "signature_type": "Line",
            "target": {
                "file": "kernel/bpf/verifier.c"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "7951363273844158997269440188261648089",
                    "278923824943629224052149208149839493838",
                    "95024830595712549718239881963116039460",
                    "67241830700915376453166430681788109394",
                    "287825870037365048958949144350964352837",
                    "297215249275033344689269068849347888893",
                    "43592083409730823798475229206434858833",
                    "50817482264475870619502068663446896134",
                    "219598259301048817366013311300163617023",
                    "229525884466669471377673659781293511242",
                    "229670240702912403965929939914899539282",
                    "43599723422404838837931357381598305072",
                    "21681151911229597155917282065768200766",
                    "100513450600306280933628058840708700840",
                    "286851154665423463784781304584671457844",
                    "138213226128574572427451668061370308842"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-38662-86fe7fa9",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6693b172f008846811f48a099f33effc26068e1e"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "may_update_sockmap"
            },
            "signature_version": "v1",
            "digest": {
                "length": 640.0,
                "function_hash": "158408658421488995327054741383336107750"
            },
            "id": "CVE-2024-38662-8ec71f58",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29467edc23818dc5a33042ffb4920b49b090e63d"
        },
        {
            "deprecated": false,
            "signature_type": "Line",
            "target": {
                "file": "kernel/bpf/verifier.c"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "7951363273844158997269440188261648089",
                    "278923824943629224052149208149839493838",
                    "95024830595712549718239881963116039460",
                    "67241830700915376453166430681788109394",
                    "287825870037365048958949144350964352837",
                    "297215249275033344689269068849347888893",
                    "43592083409730823798475229206434858833",
                    "50817482264475870619502068663446896134",
                    "219598259301048817366013311300163617023",
                    "229525884466669471377673659781293511242",
                    "229670240702912403965929939914899539282",
                    "43599723422404838837931357381598305072",
                    "21681151911229597155917282065768200766",
                    "100513450600306280933628058840708700840",
                    "286851154665423463784781304584671457844",
                    "138213226128574572427451668061370308842"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-38662-904f3c35",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11e8ecc5b86037fec43d07b1c162e233e131b1d9"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "check_map_func_compatibility"
            },
            "signature_version": "v1",
            "digest": {
                "length": 5252.0,
                "function_hash": "104542138638348329910289784630181032910"
            },
            "id": "CVE-2024-38662-995446f5",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29467edc23818dc5a33042ffb4920b49b090e63d"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "may_update_sockmap"
            },
            "signature_version": "v1",
            "digest": {
                "length": 640.0,
                "function_hash": "158408658421488995327054741383336107750"
            },
            "id": "CVE-2024-38662-9befd08b",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81e1c5a3c70398cf76631ede63a03616ed1ba3c"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "check_map_func_compatibility"
            },
            "signature_version": "v1",
            "digest": {
                "length": 6493.0,
                "function_hash": "58545810331996523129271563858237939223"
            },
            "id": "CVE-2024-38662-b0d1d822",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6693b172f008846811f48a099f33effc26068e1e"
        },
        {
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "file": "kernel/bpf/verifier.c",
                "function": "check_map_func_compatibility"
            },
            "signature_version": "v1",
            "digest": {
                "length": 6898.0,
                "function_hash": "130769171752625465129146301446658396910"
            },
            "id": "CVE-2024-38662-b8a350ba",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81e1c5a3c70398cf76631ede63a03616ed1ba3c"
        }
    ]
}

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.10.219

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.161

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.93

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.33

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.9.4