BPF Program Deletion Restriction in Linux Kernel: CVE-2024-38662
Summary
DEBIAN-CVE-2024-38662: In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoi... Affects linux versions < 5.10.221-1. Fixed in 5.10.221-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including process management, memory management, and device control. The kernel's BPF (Berkeley Packet Filter) subsystem allows for advanced packet filtering and network monitoring. However, it has been found vulnerable to improper handling of deletion operations in sockmap and sockhash, which can lead to security violations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where BPF programs could improperly delete entries from sockmap and sockhash without the necessary permissions. This issue arose from a lack of verification in the BPF verifier, which allowed certain programs to bypass restrictions intended to prevent locking rule violations. The ramifications of this vulnerability include potential system instability and security risks, as unauthorized deletions could disrupt network operations and lead to data integrity issues.
How To Fix
Minimum fixed version
5.10.221-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The vulnerability CVE-2024-38662 in the Linux kernel poses significant risks related to BPF program operations on sockmap and sockhash. Users are strongly advised to update their kernel packages to the patched versions to ensure system security and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2024-38662 is a vulnerability in the Linux kernel that allows BPF programs to delete entries from sockmap and sockhash without proper permissions.
This vulnerability can lead to system instability and security risks, as unauthorized deletions may disrupt network operations and compromise data integrity.
The vulnerability affects multiple Debian versions, including Debian 11, 12, 13, and 14, with specific fixed versions available.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan to apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.