bpf: Fix hashtab overflow check on 32-bit arches
Summary
| CVE | CVE-2024-26884 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-04-17 11:15:10 UTC |
| Updated | 2026-05-12 12:16:23 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. So apply the same fix to hashtab, by moving the overflow check to before the roundup. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-119 | CWE-190 | CWE-190 CWE-190 Integer Overflow or Wraparound
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 33ec04cadb77605b71d9298311919303d390c4d5 git | Not specified |
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 92c81fbb3ed2e0dfc33a4183a67135e1ab566ace git | Not specified |
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 64f00b4df0597590b199b62a37a165473bf658a6 git | Not specified |
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 3b08cfc65f07b1132c1979d73f014ae6e04de55d git | Not specified |
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 git | Not specified |
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 8435f0961bf3dc65e204094349bd9aeaac1f8868 git | Not specified |
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 d817f0d34d927f2deb17dadbfe212c9a6a32ac3e git | Not specified |
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 a6fa75b5096c0f9826a4fabe22d907b0a5bb1016 git | Not specified |
| CNA | Linux | Linux | affected daaf427c6ab392bedcd018e326b2ffa1e1110cd6 6787d916c2cf9850c97a0a3f73e08c43e7d973b1 git | Not specified |
| CNA | Linux | Linux | affected 3.19 | Not specified |
| CNA | Linux | Linux | unaffected 3.19 semver | Not specified |
| CNA | Linux | Linux | unaffected 4.19.311 4.19.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.4.273 5.4.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.214 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.153 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.83 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.23 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.7.11 6.7.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.8.2 6.8.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.9 * original_commit_for_fix | Not specified |
| ADP | Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux Subsystem | affected * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/d817f0d34d927f2deb17dadbfe212c9a6a32ac3e | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| lists.debian.org/debian-lts-announce/2024/06/msg00017.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| cert-portal.siemens.com/productcert/html/ssa-265688.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| git.kernel.org/stable/c/8435f0961bf3dc65e204094349bd9aeaac1f8868 | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/6787d916c2cf9850c97a0a3f73e08c43e7d973b1 | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/92c81fbb3ed2e0dfc33a4183a67135e1ab566ace | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/a6fa75b5096c0f9826a4fabe22d907b0a5bb1016 | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| lists.debian.org/debian-lts-announce/2024/06/msg00020.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| git.kernel.org/stable/c/64f00b4df0597590b199b62a37a165473bf658a6 | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/33ec04cadb77605b71d9298311919303d390c4d5 | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.