Homepage

CVE-2024-26951 Affecting kernel-libbpf-static package, versions <0:6.1.84-99.169.amzn2023

Severity

 Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.04% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-KERNELLIBBPFSTATIC-7644003
  • published7 Aug 2024
  • disclosed1 May 2024
Report a new vulnerability Found a mistake?

Introduced: 1 May 2024

CVE-2024-26951  (opens in a new tab)
First added by Snyk

How to fix?

Upgrade Amazon-Linux:2023 kernel-libbpf-static to version 0:6.1.84-99.169.amzn2023 or higher.
This issue was patched in ALAS2023-2024-696.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-libbpf-static package and not the kernel-libbpf-static package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: check for dangling peer via is_dead instead of empty list

If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a temporary list with a head on the stack of wg_peer_remove_all(). If a netlink dump is resumed and the cursored peer is one that has been removed via wg_peer_remove_all(), it will iterate from that peer and then attempt to dump freed peers.

Fix this by instead checking peer->is_dead, which was explictly created for this purpose. Also move up the device_update_lock lockdep assertion, since reading is_dead relies on that.

It can be reproduced by a small script like:

echo &#34;Setting config...&#34;
ip link add dev wg0 type wireguard
wg setconf wg0 /big-config
(
        while true; do
                echo &#34;Showing config...&#34;
                wg showconf wg0 &gt; /dev/null
        done
) &amp;
sleep 4
wg setconf wg0 &lt;(printf &#34;[Peer]\nPublicKey=$(wg genkey)\n&#34;)

Resulting in:

BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20
Read of size 8 at addr ffff88811956ec70 by task wg/59
CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5
Call Trace:
 &lt;TASK&gt;
 dump_stack_lvl+0x47/0x70
 print_address_description.constprop.0+0x2c/0x380
 print_report+0xab/0x250
 kasan_report+0xba/0xf0
 __lock_acquire+0x182a/0x1b20
 lock_acquire+0x191/0x4b0
 down_read+0x80/0x440
 get_peer+0x140/0xcb0
 wg_get_device_dump+0x471/0x1130

CVSS Scores

version 3.1