1.4 KiB
CVE-2024-49850
Description
In the Linux kernel, the following vulnerability has been resolved:bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relosIn case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCALreferencing a non-existing BTF type, function bpf_core_calc_relo_insnwould cause a null pointer deference.Fix this by adding a proper check upper in call stack, as malformedrelocation records could be passed from user space.Simplest reproducer is a program: r0 = 0 exitWith a single relocation record: .insn_off = 0, /* patch first instruction / .type_id = 100500, / this type id does not exist / .access_str_off = 6, / offset of string "0" */ .kind = BPF_CORE_TYPE_ID_LOCAL,See the link for original reproducer or next commit for a test case.
POC
Reference
No PoCs from references.