Bug 2337344 (CVE-2024-47794) - CVE-2024-47794 kernel: bpf: Prevent tailcall infinite loop caused by freplace
Summary: CVE-2024-47794 kernel: bpf: Prevent tailcall infinite loop caused by freplace
Keywords:
Status: NEW
Alias: CVE-2024-47794
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-01-13 11:56 UTC by OSIDB Bzimport
Modified: 2025-01-13 14:42 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-01-13 11:56:48 UTC
In the Linux kernel, the following vulnerability has been resolved:

bpf: Prevent tailcall infinite loop caused by freplace

There is a potential infinite loop issue that can occur when using a
combination of tail calls and freplace.

In an upcoming selftest, the attach target for entry_freplace of
tailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in
entry_freplace leads to entry_tc. This results in an infinite loop:

entry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc.

The problem arises because the tail_call_cnt in entry_freplace resets to
zero each time entry_freplace is executed, causing the tail call mechanism
to never terminate, eventually leading to a kernel panic.

To fix this issue, the solution is twofold:

1. Prevent updating a program extended by an freplace program to a
   prog_array map.
2. Prevent extending a program that is already part of a prog_array map
   with an freplace program.

This ensures that:

* If a program or its subprogram has been extended by an freplace program,
  it can no longer be updated to a prog_array map.
* If a program has been added to a prog_array map, neither it nor its
  subprograms can be extended by an freplace program.

Moreover, an extension program should not be tailcalled. As such, return
-EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a
prog_array map.

Additionally, fix a minor code style issue by replacing eight spaces with a
tab for proper formatting.

Comment 1 Avinash Hanwate 2025-01-13 12:58:17 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025011120-CVE-2024-47794-09e9@gregkh/T

Comment 3 Avinash Hanwate 2025-01-13 13:43:51 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025011120-CVE-2024-47794-09e9@gregkh/T

Comment 5 Avinash Hanwate 2025-01-13 14:37:39 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025011120-CVE-2024-47794-09e9@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.