Linux Kernel BPF Kfunc CPU Validation Vulnerability in Cgroup Rstat

A vulnerability exists in the Linux kernel's cgroup subsystem, specifically within the rstat component. The issue arises because the 'css_rstat_updated()' function, which is exposed as a BPF (Berkeley Packet Filter) kfunc, accepts a caller-provided CPU argument without validating its legitimacy. This oversight allows a BPF iter/cgroup program, granted with CAP_BPF and CAP_PERFMON, to pass an invalid CPU value. On an unpatched kernel with the UBSCAN_BOUNDS test, an invalid CPU value triggers an out-of-bounds array access, as indicated by the Undefined Behavior Sanitizer (UBSAN) error. The vulnerability has been addressed by adding CPU validation to the BPF-facing 'css_rstat_updated()' kfunc and moving the common implementation to '__css_rstat_updated()' for in-kernel callers.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition by causing an out-of-bounds array access, which can potentially be exploited to execute arbitrary code or cause a kernel panic, depending on the system's architecture and configuration.

Reproduction

To reproduce this vulnerability, a BPF iter/cgroup program must be created and executed with CAP_BPF and CAP_PERFMON capabilities. The program can then pass an invalid CPU value, such as 0x7fffffff, to the 'css_rstat_updated()' function. This will trigger an out-of-bounds access, as the value 2147483647 exceeds the valid range for the per-CPU rstat lookups.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched kernel can be found on the official Linux kernel website.