BPF_PROG_TYPE_CGROUP_SKB Attach Type Enforcement Vulnerability in Linux Package
Summary
DEBIAN-CVE-2024-38564: In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type... Affects linux versions < 6.8.12-1. Fixed in 6.8.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It supports various functionalities, including process management, memory management, and device control. This vulnerability affects the BPF (Berkeley Packet Filter) subsystem, specifically related to the enforcement of attach types for cgroup_skb programs, which can lead to improper associations and potential security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the BPF subsystem where the attach type enforcement for BPF_PROG_TYPE_CGROUP_SKB was not properly implemented. This oversight allows cgroup_skb program types to be attached to incorrect cgroup hooks, potentially leading to unauthorized access or manipulation of network traffic. The issue arises from the lack of verification in the link_create function, which fails to enforce the correct association between program types and attach types, posing a significant security risk.
How To Fix
Minimum fixed version
6.8.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch by updating the Linux package.
Conclusion
The BPF_PROG_TYPE_CGROUP_SKB attach type enforcement vulnerability in the Linux package poses a significant security risk due to improper program type associations. Users are strongly advised to update their Linux packages to the patched version 6.8.12-1 to mitigate potential threats. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can allow unauthorized attachment of cgroup_skb programs to incorrect hooks, potentially leading to security breaches and manipulation of network traffic.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patch has been released in version 6.8.12-1 of the Linux package. Users should update to this version or later.
While there are no specific workarounds, it is crucial to prioritize updating your package to mitigate the risk associated with this vulnerability.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-38564.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
