Bug 2226783 (CVE-2023-39191, ZDI-CAN-19399)

Summary:	CVE-2023-39191 kernel: eBPF: insufficient stack type checks in dynptr
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, crwood, cye, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, nmurray, ptalbert, qzhao, rhandlin, rogbas, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, security-response-team, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ykopkova, ymankad, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.3-rc1	Doc Type:	If docs needed, set a value
Doc Text:	An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2227282, 2227283, 2227284, 2227285, 2227286, 2242087
Bug Blocks:	2225771

Description Mauro Matteo Cascella 2023-07-26 14:04:59 UTC

BPF recently supported a new feature, dynptr (https://lwn.net/Articles/895885). An improper input validation issue was found in dynptr, potentially leading to local privilege escalation. This flaw requires CAP_BPF to be exploited.

Comment 14 Mauro Matteo Cascella 2023-10-04 10:19:24 UTC

Upstream patch:
https://lore.kernel.org/all/20230121002241.2113993-1-memxor@gmail.com/

Comment 15 Mauro Matteo Cascella 2023-10-04 10:22:35 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2242087]

Comment 16 Mauro Matteo Cascella 2023-10-04 17:12:37 UTC

ZDI security advisory:
https://www.zerodayinitiative.com/advisories/ZDI-CAN-19399

Comment 17 Justin M. Forbes 2023-10-05 14:23:12 UTC

This was fixed for Fedora with the 6.2.3 stable kernel updates.

Comment 18 errata-xmlrpc 2023-11-07 08:20:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6583 https://access.redhat.com/errata/RHSA-2023:6583

Comment 19 errata-xmlrpc 2024-01-23 17:50:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0381 https://access.redhat.com/errata/RHSA-2024:0381

Comment 20 errata-xmlrpc 2024-01-24 16:35:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0439 https://access.redhat.com/errata/RHSA-2024:0439

Comment 21 errata-xmlrpc 2024-01-24 16:37:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0448 https://access.redhat.com/errata/RHSA-2024:0448