bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.110, 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks _bpf_setsockopt() and _bpf_getsockopt() call sock_owned_by_me() for full sockets, so these helpers expect the socket lock to be held. BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME run BPF programs without acquiring the socket lock. A program attached to either hook can therefore trigger the sock_owned_by_me() warning by calling bpf_setsockopt() or bpf_getsockopt(). Disallow bpf_setsockopt() and bpf_getsockopt() for CGROUP_UNIX_GETPEERNAME and CGROUP_UNIX_GETSOCKNAME.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 859051dd165ec6cc915f0f2114699021144fd249 · fixed in 61769b9c882a964af3a6ebd9a8e43615f8713234; From 859051dd165ec6cc915f0f2114699021144fd249 · fixed in fe91c3f64a738dd97e8542ad5bdfbe5ac430edf6; From 859051dd165ec6cc915f0f2114699021144fd249 · fixed in daeb74f5f398e847d1d42906aec6610406a34fdc; From 859051dd165ec6cc915f0f2114699021144fd249 · fixed in 84473a7e1813a2da7b759ab1d098a84998c8d3f5
- Linux Linux
6.7
- KernelLinux
From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6