Bug 2313102 (CVE-2024-46754) - CVE-2024-46754 kernel: bpf: Remove tst_run from lwt_seg6local_prog_ops.
Summary: CVE-2024-46754 kernel: bpf: Remove tst_run from lwt_seg6local_prog_ops.
Keywords:
Status: NEW
Alias: CVE-2024-46754
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2313198
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-09-18 08:21 UTC by OSIDB Bzimport
Modified: 2024-09-18 10:15 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2024-09-18 08:21:45 UTC 
In the Linux kernel, the following vulnerability has been resolved:

bpf: Remove tst_run from lwt_seg6local_prog_ops.

The syzbot reported that the lwt_seg6 related BPF ops can be invoked
via bpf_test_run() without without entering input_action_end_bpf()
first.

Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL
probably didn't work since it was introduced in commit 04d4b274e2a
("ipv6: sr: Add seg6local action End.BPF"). The reason is that the
per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self
test case but each BPF function expects it.

Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.
Comment 1 Michal Findra 2024-09-18 10:04:30 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024091840-CVE-2024-46754-7f04@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.