{"id":"DEBIAN-CVE-2024-47702","details":"In the Linux kernel, the following vulnerability has been resolved:  bpf: Fail verification for sign-extension of packet data/data_end/data_meta  syzbot reported a kernel crash due to   commit 1f1e864b6555 (\"bpf: Handle sign-extenstin ctx member accesses\"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field.  The original code looks like:         r2 = *(s32 *)(r1 + 76) /* load __sk_buff-\u003edata */         r3 = *(u32 *)(r1 + 80) /* load __sk_buff-\u003edata_end */         r0 = r2         r0 += 8         if r3 \u003e r0 goto +1         ... Note that __sk_buff-\u003edata load has 32-bit sign extension.  After verification and convert_ctx_accesses(), the final asm code looks like:         r2 = *(u64 *)(r1 +208)         r2 = (s32)r2         r3 = *(u64 *)(r1 +80)         r0 = r2         r0 += 8         if r3 \u003e r0 goto pc+1         ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff-\u003edata address invalid which may cause runtime failure.  Currently, in C code, typically we have         void *data = (void *)(long)skb-\u003edata;         void *data_end = (void *)(long)skb-\u003edata_end;         ... and it will generate         r2 = *(u64 *)(r1 +208)         r3 = *(u64 *)(r1 +80)         r0 = r2         r0 += 8         if r3 \u003e r0 goto pc+1  If we allow sign-extension,         void *data = (void *)(long)(int)skb-\u003edata;         void *data_end = (void *)(long)skb-\u003edata_end;         ... the generated code looks like         r2 = *(u64 *)(r1 +208)         r2 \u003c\u003c= 32         r2 s\u003e\u003e= 32         r3 = *(u64 *)(r1 +80)         r0 = r2         r0 += 8         if r3 \u003e r0 goto pc+1 and this will cause verification failure since \"r2 \u003c\u003c= 32\" is not allowed as \"r2\" is a packet pointer.  To fix this issue for case   r2 = *(s32 *)(r1 + 76) /* load __sk_buff-\u003edata */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail.    [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/","modified":"2026-09-15T09:02:58.435342088Z","published":"2024-10-21T12:15:06.743Z","upstream":["CVE-2024-47702"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-47702"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-47702.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-47702.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}