Bug 2281677 (CVE-2024-35895)

Summary:	CVE-2024-35895 kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem
Product:	[Other] Security Response	Reporter:	ybuenos
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, sidakwo, sukulkar, tglozar, tyberry, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.4.274, kernel 5.10.215, kernel 5.15.154, kernel 6.1.85, kernel 6.6.26, kernel 6.8.5, kernel 6.9	Doc Type:	If docs needed, set a value
Doc Text:	CVE-2024-35895 addresses a vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, specifically within the sockmap feature. The issue arises when BPF tracing programs, which can execute in various interrupt contexts, attempt to delete elements from sockmap or sockhash maps. This operation involves acquiring locks that are not safe for use in hard interrupt contexts, leading to potential deadlocks due to lock inversion. BPF tracing programs may delete elements from sockmap/sockhash maps while running in interrupt contexts where the required locks are not hardirq-safe, causing possible deadlocks. System hangs or crashes due to deadlocks when deleting elements from sockmap/sockhash maps in inappropriate contexts.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2281678
Bug Blocks:	2281751

Description ybuenos 2024-05-20 11:34:36 UTC

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Prevent lock inversion deadlock in map delete elem

The Linux kernel CVE team has assigned CVE-2024-35895 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051950-CVE-2024-35895-cb33@gregkh/T

Comment 1 ybuenos 2024-05-20 11:35:15 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2281678]

Comment 5 Alex 2024-06-09 15:32:45 UTC

The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-35895 is: CHECK	Maybe valid. Check manually. with impact MODERATE (that is approximation based on flags REMOTE DEADLOCK BPF  ; these flags parsed automatically based on patche data). Such automatic check happens only for Low/Moderates (and only when not from reporter, but parsing already existing CVE). Highs always checked manually (I check it myself and then we check it again in Remediation team). In rare cases some of the Moderates could be increased to High later.

Comment 17 errata-xmlrpc 2024-09-04 00:11:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:6268 https://access.redhat.com/errata/RHSA-2024:6268

Comment 18 errata-xmlrpc 2024-09-04 00:25:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:6267 https://access.redhat.com/errata/RHSA-2024:6267

Comment 20 errata-xmlrpc 2024-09-24 02:49:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:6997 https://access.redhat.com/errata/RHSA-2024:6997