In the Linux kernel, the following vulnerability has been resolved:
bpf: Prevent tailcall infinite loop caused by freplace
There is a potential infinite loop issue that can occur when using a combination of tail calls and freplace.
In an upcoming selftest, the attach target for entryfreplace of tailcallfreplace.c is subprogtc of tcbpf2bpf.c, while the tail call in entryfreplace leads to entrytc. This results in an infinite loop:
entrytc -> subprogtc -> entryfreplace --tailcall-> entrytc.
The problem arises because the tailcallcnt in entryfreplace resets to zero each time entryfreplace is executed, causing the tail call mechanism to never terminate, eventually leading to a kernel panic.
To fix this issue, the solution is twofold:
This ensures that:
Moreover, an extension program should not be tailcalled. As such, return -EINVAL if the program has a type of BPFPROGTYPEEXT when adding it to a progarray map.
Additionally, fix a minor code style issue by replacing eight spaces with a tab for proper formatting.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_tracing_link_release",
"file": "kernel/bpf/syscall.c"
},
"id": "CVE-2024-47794-04adde78",
"digest": {
"length": 316.0,
"function_hash": "144058505502550877771004848333519600487"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__bpf_trampoline_link_prog",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-1271516c",
"digest": {
"length": 1020.0,
"function_hash": "236560581835419526283250188993572146776"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-160bc0fd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72229093575129954650668830232731526797",
"212091525794728057613582256181650396868",
"175651847990227675905046590488414036379",
"47166640795523132468576907271772852502",
"142958081557976022999822950400670952082",
"178436147889844561899416770924897076594",
"22848810694077429988584919226753726808",
"311257521070948973921365776565062048305",
"38126685861222742298836603547920330529",
"76097274872214030076197134052176164636",
"259281490607471329990440716232808869947",
"312427689591794822641385913942758272046",
"179924763033430191072268653155824737586",
"238319715612882260690387510709063591993",
"173454195060223811203713154177645772128",
"123711626811347896138859851079685016354",
"186177727156543425825117582213953093564",
"225376752835436130558750165147207315744",
"89458318917663984442702310110219479408",
"338249108190599560369779526678378609751",
"174258392531017844186637042787953784554",
"173799575097303157682059791244517892753",
"265830539120529560314018514463271356110",
"232607486941722884990988697992448162299",
"112545139089120711319287387737346887091",
"73610266033052502838553390823671781983",
"98851243816937799294805519152923714402",
"63288899611913437177564935098091024151",
"114669969847264079316249923416342389933",
"242705439456037423341148761126281400031",
"149727668439353971671982042595760306625",
"114456416844950450001062836513755579118",
"221677890037723216588666586282303217693",
"140932682435042716513037761047673676239",
"303501047250433375165393945932126171564",
"117858814944748303564093591923799730378",
"34196765548883550325796480884024167680",
"164898145853876635525524960198880100166",
"119049488949927072139849698499977149678",
"329891280181171963949323596949750897666"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/bpf/syscall.c"
},
"id": "CVE-2024-47794-1ddb9bc4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"185167528478621972456358738156088110057",
"28589348307432598082538907873435530566",
"187306885174513094539785996955831774962",
"271734810591216713955426916371851752461",
"156767559142777839225145817961290871864",
"207313052869101080543289051872989646996",
"74928851623121582805832111572893757372",
"311924895373011634942235970833817269841",
"321157340091810899297781109008812000428",
"60853096019572929216205059503440869592",
"27858957916217899107383915346946906059"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/bpf/arraymap.c"
},
"id": "CVE-2024-47794-1f6b1f73",
"digest": {
"threshold": 0.9,
"line_hashes": [
"140304955332390298896189274564331239058",
"182161014472697727339984306287240843912",
"78502442653524067416622523281366517385",
"98931389918933568361579169363376526997",
"82133893205473523793376729212476598932",
"241250449169317743327106026838623890144",
"48000613967556782945115520769109647984",
"197744091625444554063495516517871459726",
"108963009647433207961612177139450735316",
"319753609570601134433134606153208291193",
"202047077470324823226680739568373838014",
"139483707132364476545275167656351889543",
"179116050026837567404349502863445549566",
"50342511850976452419517146678727051416",
"75032302537025847132805454557716747722"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "prog_fd_array_get_ptr",
"file": "kernel/bpf/arraymap.c"
},
"id": "CVE-2024-47794-343163bf",
"digest": {
"length": 248.0,
"function_hash": "115830783519370717507844559464931477148"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_prog_alloc_no_stats",
"file": "kernel/bpf/core.c"
},
"id": "CVE-2024-47794-3ccdd85b",
"digest": {
"length": 1013.0,
"function_hash": "102623014182514250290833761834325784992"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_shim_tramp_link_release",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-530828c5",
"digest": {
"length": 310.0,
"function_hash": "311413728022541240377729498993794839954"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-70b9adcc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72229093575129954650668830232731526797",
"212091525794728057613582256181650396868",
"175651847990227675905046590488414036379",
"47166640795523132468576907271772852502",
"142958081557976022999822950400670952082",
"178436147889844561899416770924897076594",
"22848810694077429988584919226753726808",
"311257521070948973921365776565062048305",
"38126685861222742298836603547920330529",
"76097274872214030076197134052176164636",
"259281490607471329990440716232808869947",
"312427689591794822641385913942758272046",
"179924763033430191072268653155824737586",
"238319715612882260690387510709063591993",
"173454195060223811203713154177645772128",
"123711626811347896138859851079685016354",
"186177727156543425825117582213953093564",
"225376752835436130558750165147207315744",
"89458318917663984442702310110219479408",
"338249108190599560369779526678378609751",
"174258392531017844186637042787953784554",
"173799575097303157682059791244517892753",
"265830539120529560314018514463271356110",
"232607486941722884990988697992448162299",
"112545139089120711319287387737346887091",
"73610266033052502838553390823671781983",
"98851243816937799294805519152923714402",
"63288899611913437177564935098091024151",
"114669969847264079316249923416342389933",
"242705439456037423341148761126281400031",
"149727668439353971671982042595760306625",
"114456416844950450001062836513755579118",
"221677890037723216588666586282303217693",
"140932682435042716513037761047673676239",
"303501047250433375165393945932126171564",
"117858814944748303564093591923799730378",
"34196765548883550325796480884024167680",
"164898145853876635525524960198880100166",
"119049488949927072139849698499977149678",
"329891280181171963949323596949750897666"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__bpf_trampoline_link_prog",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-75aca2e1",
"digest": {
"length": 1020.0,
"function_hash": "236560581835419526283250188993572146776"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_link_prog",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-786f656d",
"digest": {
"length": 176.0,
"function_hash": "177897811957620386771721505531052422291"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_shim_tramp_link_release",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-7a253b69",
"digest": {
"length": 310.0,
"function_hash": "311413728022541240377729498993794839954"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_tracing_prog_attach",
"file": "kernel/bpf/syscall.c"
},
"id": "CVE-2024-47794-84e91dc0",
"digest": {
"length": 3096.0,
"function_hash": "325649593445935408842180833936715360702"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/bpf/syscall.c"
},
"id": "CVE-2024-47794-86f53eab",
"digest": {
"threshold": 0.9,
"line_hashes": [
"185167528478621972456358738156088110057",
"28589348307432598082538907873435530566",
"187306885174513094539785996955831774962",
"271734810591216713955426916371851752461",
"156767559142777839225145817961290871864",
"207313052869101080543289051872989646996",
"74928851623121582805832111572893757372",
"311924895373011634942235970833817269841",
"321157340091810899297781109008812000428",
"60853096019572929216205059503440869592",
"27858957916217899107383915346946906059"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__bpf_trampoline_unlink_prog",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-881c6292",
"digest": {
"length": 456.0,
"function_hash": "296046396810690012082543808205257932971"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/bpf/core.c"
},
"id": "CVE-2024-47794-8a58e0c8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159889888097519951631935127174351806915",
"160871143059109051391339551852588444829",
"169748512891391340591355141996669580391",
"143496613383804741197781454750975225694"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_link_prog",
"file": "include/linux/bpf.h"
},
"id": "CVE-2024-47794-8b0df07a",
"digest": {
"length": 86.0,
"function_hash": "233948424266987305860005373610734171254"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_link_prog",
"file": "include/linux/bpf.h"
},
"id": "CVE-2024-47794-8d2fc96d",
"digest": {
"length": 86.0,
"function_hash": "233948424266987305860005373610734171254"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_unlink_prog",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-8e0606d8",
"digest": {
"length": 176.0,
"function_hash": "177897811957620386771721505531052422291"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__bpf_trampoline_unlink_prog",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-96c853ff",
"digest": {
"length": 456.0,
"function_hash": "296046396810690012082543808205257932971"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_prog_alloc_no_stats",
"file": "kernel/bpf/core.c"
},
"id": "CVE-2024-47794-975d9686",
"digest": {
"length": 1013.0,
"function_hash": "102623014182514250290833761834325784992"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/linux/bpf.h"
},
"id": "CVE-2024-47794-9c66c8a4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"135313295610766961870808880176958860897",
"269144238128110367870884480249308876771",
"25128926757698004990520352474539123767",
"177024301684118912176041297059537667225",
"74445081048180664671433192388272566729",
"50193440438669515604681108754242138662",
"34694714279455846501110281654147546816",
"183072509750141375045673541216447185630",
"252683562652949287809267915923083016366",
"306000500885774238241541016492232766246",
"168413844780219504501841162296180436059",
"203707188772191649476810640097996804715",
"226742207398171639866729940950754738497",
"252683562652949287809267915923083016366",
"81226995095866953483076106303697848809",
"248045829924084363489590758625781298140",
"104281984600717261827279091538895684960",
"261181438126677228344053268042724814135"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_unlink_prog",
"file": "include/linux/bpf.h"
},
"id": "CVE-2024-47794-9f4c2a52",
"digest": {
"length": 86.0,
"function_hash": "233948424266987305860005373610734171254"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_tracing_prog_attach",
"file": "kernel/bpf/syscall.c"
},
"id": "CVE-2024-47794-a5690b42",
"digest": {
"length": 3096.0,
"function_hash": "325649593445935408842180833936715360702"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/bpf/core.c"
},
"id": "CVE-2024-47794-a9d5d70e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159889888097519951631935127174351806915",
"160871143059109051391339551852588444829",
"169748512891391340591355141996669580391",
"143496613383804741197781454750975225694"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_unlink_prog",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-adac58ab",
"digest": {
"length": 176.0,
"function_hash": "177897811957620386771721505531052422291"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_tracing_link_release",
"file": "kernel/bpf/syscall.c"
},
"id": "CVE-2024-47794-b1887657",
"digest": {
"length": 316.0,
"function_hash": "144058505502550877771004848333519600487"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "prog_fd_array_get_ptr",
"file": "kernel/bpf/arraymap.c"
},
"id": "CVE-2024-47794-bd832f6e",
"digest": {
"length": 248.0,
"function_hash": "115830783519370717507844559464931477148"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/linux/bpf.h"
},
"id": "CVE-2024-47794-d8465d7a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"135313295610766961870808880176958860897",
"269144238128110367870884480249308876771",
"25128926757698004990520352474539123767",
"177024301684118912176041297059537667225",
"74445081048180664671433192388272566729",
"50193440438669515604681108754242138662",
"34694714279455846501110281654147546816",
"183072509750141375045673541216447185630",
"252683562652949287809267915923083016366",
"306000500885774238241541016492232766246",
"168413844780219504501841162296180436059",
"203707188772191649476810640097996804715",
"226742207398171639866729940950754738497",
"252683562652949287809267915923083016366",
"81226995095866953483076106303697848809",
"248045829924084363489590758625781298140",
"104281984600717261827279091538895684960",
"261181438126677228344053268042724814135"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_link_cgroup_shim",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-d9cc449e",
"digest": {
"length": 966.0,
"function_hash": "103409465180326133134442389378808570697"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_link_cgroup_shim",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-dbe405b8",
"digest": {
"length": 966.0,
"function_hash": "103409465180326133134442389378808570697"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/bpf/arraymap.c"
},
"id": "CVE-2024-47794-e0523794",
"digest": {
"threshold": 0.9,
"line_hashes": [
"140304955332390298896189274564331239058",
"182161014472697727339984306287240843912",
"78502442653524067416622523281366517385",
"98931389918933568361579169363376526997",
"82133893205473523793376729212476598932",
"241250449169317743327106026838623890144",
"48000613967556782945115520769109647984",
"197744091625444554063495516517871459726",
"108963009647433207961612177139450735316",
"319753609570601134433134606153208291193",
"202047077470324823226680739568373838014",
"139483707132364476545275167656351889543",
"179116050026837567404349502863445549566",
"50342511850976452419517146678727051416",
"75032302537025847132805454557716747722"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6083f040d5d8f8d748462c77e90547097df936e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_unlink_prog",
"file": "include/linux/bpf.h"
},
"id": "CVE-2024-47794-f1d4a3d9",
"digest": {
"length": 86.0,
"function_hash": "233948424266987305860005373610734171254"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987aa730bad3e1ef66d9f30182294daa78f6387d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bpf_trampoline_link_prog",
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2024-47794-ffed7662",
"digest": {
"length": 176.0,
"function_hash": "177897811957620386771721505531052422291"
},
"signature_type": "Function"
}
]