In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets
With a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messages sent from one TCP socket (s1) to actually egress from another TCP socket (s2):
tcp_bpf_sendmsg(s1) // = sk_prot->sendmsg tcp_bpf_send_verdict(s1) // __SK_REDIRECT case tcp_bpf_sendmsg_redir(s2) tcp_bpf_push_locked(s2) tcp_bpf_push(s2) tcp_rate_check_app_limited(s2) // expects tcp_sock tcp_sendmsg_locked(s2) // ditto
There is a hard-coded assumption in the call-chain, that the egress socket (s2) is a TCP socket.
However in commit 122e6c79efe1 ("sock_map: Update sock type checks for UDP") we have enabled redirects to non-TCP sockets. This was done for the sake of BPF sk_skb programs. There was no indention to support sk_msg send-to-egress use case.
As a result, attempts to send-to-egress through a non-TCP socket lead to a crash due to invalid downcast from sock to tcp_sock:
BUG: kernel NULL pointer dereference, address: 000000000000002f ... Call Trace: <TASK> ? show_regs+0x60/0x70 ? __die+0x1f/0x70 ? page_fault_oops+0x80/0x160 ? do_user_addr_fault+0x2d7/0x800 ? rcu_is_watching+0x11/0x50 ? exc_page_fault+0x70/0x1c0 ? asm_exc_page_fault+0x27/0x30 ? tcp_tso_segs+0x14/0xa0 tcp_write_xmit+0x67/0xce0 __tcp_push_pending_frames+0x32/0xf0 tcp_push+0x107/0x140 tcp_sendmsg_locked+0x99f/0xbb0 tcp_bpf_push+0x19d/0x3a0 tcp_bpf_sendmsg_redir+0x55/0xd0 tcp_bpf_send_verdict+0x407/0x550 tcp_bpf_sendmsg+0x1a1/0x390 inet_sendmsg+0x6a/0x70 sock_sendmsg+0x9d/0xc0 ? sockfd_lookup_light+0x12/0x80 __sys_sendto+0x10e/0x160 ? syscall_enter_from_user_mode+0x20/0x60 ? __this_cpu_preempt_check+0x13/0x20 ? lockdep_hardirqs_on+0x82/0x110 __x64_sys_sendto+0x1f/0x30 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Reject selecting a non-TCP sockets as redirect target from a BPF sk_msg program to prevent the crash. When attempted, user will receive an EACCES error from send/sendto/sendmsg() syscall.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade perfUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade kernel-develUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.136-90.144Upgrade bpftoolUpgrade python-perf | Jul 9, 2024 | Mar 2, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel-libbpf-staticUpgrade kernel-develUpgrade kernel-libbpf-develUpgrade python3-perfUpgrade bpftool-debuginfoUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernelUpgrade kernel-livepatch-6.1.59-84.139Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-headersUpgrade kernel-modules-extra | Feb 17, 2025 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade kernel-debug-develUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-rtUpgrade dtb-freescaleUpgrade reiserfs-kmp-rtUpgrade kernel-source-azureUpgrade dtb-broadcomUpgrade dtb-marvellUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-source-vanillaUpgrade kernel-default-baseUpgrade dtb-renesasUpgrade kernel-azure-optionalUpgrade dtb-amazonUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade kernel-docs-htmlUpgrade gfs2-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade kernel-azureUpgrade kernel-obs-buildUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-docsUpgrade dtb-amdUpgrade kernel-source-rtUpgrade kernel-macrosUpgrade dtb-socionextUpgrade kernel-64kbUpgrade kernel-azure-extraUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-default-extraUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-azureUpgrade dtb-lgUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-kvmsmallUpgrade kernel-rt-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-rtUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade dtb-apmUpgrade kernel-default-optionalUpgrade dtb-alteraUpgrade kernel-sourceUpgrade gfs2-kmp-rtUpgrade dtb-qcomUpgrade cluster-md-kmp-64kbUpgrade dtb-exynosUpgrade kernel-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-mediatekUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade dtb-sprdUpgrade dtb-armUpgrade kernel-rt-livepatchUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-rockchipUpgrade kernel-devel-rtUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-rt-develUpgrade kernel-default-base-rebuildUpgrade kernel-default-vdsoUpgrade kernel-syms-azureUpgrade dtb-nvidiaUpgrade dlm-kmp-64kb | Apr 17, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-bluefieldUpgrade linux-raspiUpgrade linux-realtimeUpgrade linux-fipsUpgrade linux-xilinx-zynqmpUpgrade linux-kvmUpgrade linux-oracleUpgrade linux-nvidia-6.5Upgrade linux-oracle-6.5Upgrade linux-gcpUpgrade linux-lowlatency-hwe-5.15Upgrade linux-ibmUpgrade linux-oem-6.5Upgrade linux-azureUpgrade linux-nvidiaUpgrade linux-riscvUpgrade linux-azure-5.15Upgrade linux-hwe-5.15Upgrade linux-gkeop-5.15Upgrade linux-riscv-5.15Upgrade linux-lowlatencyUpgrade linux-gkeUpgrade linux-nvidia-tegra-igxUpgrade linux-intel-iot-realtimeUpgrade linux-nvidia-tegraUpgrade linux-nvidia-tegra-5.15Upgrade linux-ibm-5.15Upgrade linux-awsUpgrade linux-aws-fipsUpgrade linux-oracle-5.15Upgrade linux-gkeopUpgrade linux-gcp-fipsUpgrade linux-gcp-6.5Upgrade linux-laptopUpgrade linuxUpgrade linux-lowlatency-hwe-6.5Upgrade linux-hwe-6.5 | Nov 19, 2024 | Mar 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub