On Wed, Jun 26, 2024 at 02:44:31PM +0800, Shung-Hsi Yu wrote: > On Wed, Jun 19, 2024 at 03:36:13PM GMT, Greg Kroah-Hartman wrote: > > In the Linux kernel, the following vulnerability has been resolved: > > > > bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE > > > > bpf_prog_attach uses attach_type_to_prog_type to enforce proper > > attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses > > bpf_prog_get and relies on bpf_prog_attach_check_attach_type > > to properly verify prog_type <> attach_type association. > > > > Add missing attach_type enforcement for the link_create case. > > Otherwise, it's currently possible to attach cgroup_skb prog > > types to other cgroup hooks. > > > > The Linux kernel CVE team has assigned CVE-2024-38564 to this issue. > > > > > > Affected and fixed versions > > =========================== > > > > Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.6.33 with commit 6675c541f540 > > Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.8.12 with commit 67929e973f5a > > Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.9.3 with commit b34bbc766510 > > Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.10-rc1 with commit 543576ec15b1 > > I'd like to dispute the affected commit for this CVE. > > The commit that introduced the issue should instead be commit > 4a1e7c0c63e02 ("bpf: Support attaching freplace programs to multiple > attach points") in 5.10. > > When link_create() was added in commit af6eea57437a, it uses > bpf_prog_get_type(attr->link_create.prog_fd, ptype) to resolve struct > bpf_prog, which effectively does the requried > > prog->type == attach_type_to_prog_type(attach_type) > > check through bpf_prog_get_ok(), and thus would not allow > BPF_PROG_TYPE_CGROUP_SKB to be attached to other cgroup hooks. > > It is in commit 4a1e7c0c63e02 ("bpf: Support attaching freplace programs > to multiple attach points") that had bpf_prog_get_type() replaced with > bpf_prog_get() and lead to the removal of such check, making it possible > to attach BPF_PROG_TYPE_CGROUP_SKB to other cgroup hooks. > > [...] Thanks for the information, we have now adjusted the vulnerable commit and pushed out the new json information to cve.org greg k-h