CVE-2024-35917: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35917 affects the Linux kernel's s390/bpf subsystem. The vulnerability was discovered by Kui-Feng Lee who reported a crash on s390x triggered by the dummy_st_ops/dummy_init_ptr_arg test. The issue was identified in March 2024 and involves pointer arithmetic in the bpf_plt functionality (Kernel Commit).

The vulnerability stems from GCC's behavior of moving memcpy() operations after assignments in bpf_jit_plt(), which results in NULL pointers being written instead of the return and target addresses. This occurs because GCC's alias analysis incorrectly assumes that the memcpy() destination and the assignments' left-hand-sides are based on different objects (new_plt and bpf_plt_ret/bpf_plt_target). The root cause is a violation of the C standard regarding pointer subtraction, where both pointers must point to elements of the same array object (Kernel Commit).

The vulnerability can cause system crashes when executing certain BPF operations on s390x architecture systems. The issue specifically manifests during the execution of the dummy_st_ops/dummy_init_ptr_arg test, leading to system instability (Kernel Commit).

The vulnerability is triggered through specific BPF operations on s390x systems. It requires executing code that interacts with the affected bpf_plt functionality, as demonstrated by the dummy_st_ops/dummy_init_ptr_arg test case (Kernel Commit).

The issue has been fixed by restructuring the code to avoid the problematic pointer arithmetic. The fix involves hardcoding offsets instead of relying on pointer subtraction between distinct objects. The patch has been implemented in the Linux kernel through multiple commits (Kernel Commit, Stable Commit 1, Stable Commit 2).