CVE-2024-26885

Vulnerability

Overview

CVE-2024-26885 describes an integer overflow vulnerability in the Linux kernel's BPF subsystem, specifically within the devmap code for hash-based maps (DEVMAP_HASH). The bug resides in the calculation of the number of hash buckets: the code allocates a number equal to the next power of two of the max_entries value provided at map creation. On 32-bit architectures, the variable storing the bucket count is a 32-bit unsigned integer, which can overflow when max_entries is larger than 0x80000000. The existing overflow check only triggered if the final truncated value became zero, but on 32-bit systems the internal left-shift operation during rounding up can itself overflow, leading to undefined behavior and a crash. This was reproduced by syzbot on arm32 by creating a DEVMAP_HASH with max_entries > 0x80000000 and then performing an update. [1][2]

Attack

Vector

To exploit this vulnerability, an attacker would need to have the ability to create and update a BPF DEVMAP_HASH map on a system running a 32-bit kernel (such as arm32). This typically requires a privileged user or specific BPF-related capabilities (e.g., CAP_BPF). The attack does not require physical access but relies on the ability to provide crafted max_entries values via the bpf() syscall. No authentication bypass is needed if the attacker already has such permissions. [1]

Impact

Successful exploitation can crash the kernel (denial of service) due to the undefined behavior and resulting memory corruption. The crash was confirmed on arm32, and similar systems with 32-bit unsigned long types are potentially affected. The vulnerability does not directly lead to arbitrary code execution based on the description, but a system crash can be leveraged to disrupt operations or cause further instability. [1]

Mitigation

The fix moves the overflow check to before the rounding-up operation, preventing the undefined shift. Patched versions are available in the Linux kernel stable trees; administrators should update their kernels to include the commit that resolves this issue. Systems with 64-bit architecture are not affected due to the larger unsigned long size. Siemens has also listed this CVE as affecting their SIMATIC S7-1500 TM MFP - GNU/Linux subsystem across all versions. [1][4]