Linux kernel BPF verifier: variable-offset arithmetic on flow_keys pointers passes verification and reads out of bounds

CVSS 7.8CVE-2024-26589Kernel, userspace & hypervisorcurated

Impact

check_flow_keys_access() validated only the fixed part of the offset, so a program could add a register-held variable offset to a PTR_TO_FLOW_KEYS pointer and still verify. The published trace shows the resulting load faulting on an unmapped kernel address from inside the BPF dispatcher - an out-of-bounds kernel read that crashes the node, and with a tuned offset reads kernel memory the program should never see. Flow dissector programs are loaded by networking and observability tooling that runs on every node of a GPU cluster. A verifier bypass is worse than an ordinary kernel bug because the verifier is the entire reason loading BPF is considered safe.

Who can reach it

Local user able to load a BPF flow dissector program or run BPF_PROG_TEST_RUN against one - in practice CAP_BPF/CAP_NET_ADMIN or root, including a container granted those capabilities. Not reachable by an unprivileged tenant pod.

What to do

Update to a kernel carrying the fix, which rejects variable-offset arithmetic on flow_keys outright; five stable backport commits are listed. Rolling the kernel means draining and rebooting each node. As an interim mitigation, drop CAP_BPF and CAP_NET_ADMIN from workloads that do not need to load programs.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-26589 https://git.kernel.org/stable/c/1b500d5d6cecf98dd6ca88bc9e7ae1783c83e6d3 https://git.kernel.org/stable/c/22c7fa171a02d310e3a3f6ed46a698ca8a0060ed

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.