Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2024-26591

Disclosure Date: February 22, 2024 •
CVE-2024-26591 CVSS v3 Base Score: 5.5
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix re-attachment branch in bpf_tracing_prog_attach

The following case can cause a crash due to missing attach_btf:

  1. load rawtp program
  2. load fentry program with rawtp as target_fd
  3. create tracing link for fentry program with target_fd = 0
  4. repeat 3

In the end we have:

  • prog->aux->dst_trampoline == NULL

  • tgt_prog == NULL (because we did not provide target_fd to link_create)

  • prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X)

  • the program was loaded for tgt_prog but we have no way to find out which one

    BUG: kernel NULL pointer dereference, address: 0000000000000058
    Call Trace:
    <TASK>
    ? __die+0x20/0x70
    ? page_fault_oops+0x15b/0x430
    ? fixup_exception+0x22/0x330
    ? exc_page_fault+0x6f/0x170
    ? asm_exc_page_fault+0x22/0x30
    ? bpf_tracing_prog_attach+0x279/0x560
    ? btf_obj_id+0x5/0x10
    bpf_tracing_prog_attach+0x439/0x560
    __sys_bpf+0x1cf4/0x2de0
    __x64_sys_bpf+0x1c/0x30
    do_syscall_64+0x41/0xf0
    entry_SYSCALL_64_after_hwframe+0x6e/0x76

Return -EINVAL in this situation.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
5.5 Medium
Impact Score:
3.6
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
Linux a7b98aa10f89
Linux not down converted
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • linux

Products

  • linux kernel
Technical Analysis