Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6: security update to 18613.263.49

medium Tenable Self-Hosted Container Security Plugin ID 472406

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: bpf: track changes_pkt_data property
for global functions When processing calls to certain helpers, verifier invalidates all packet pointers in
a current state. For example, consider the following program: __attribute__((__noinline__)) long
skb_pull_data(struct __sk_buff *sk, __u32 len) { return bpf_skb_pull_data(sk, len); } SEC("tc") int
test_invalidate_checks(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; if ((void *)(p + 1) >
(void *)(long)sk->data_end) return TCX_DROP; skb_pull_data(sk, 0); *p = 42; return TCX_PASS; } After a
call to bpf_skb_pull_data() the pointer 'p' can't be used safely. See function
filter.c:bpf_helper_changes_pkt_data() for a list of such helpers. At the moment verifier invalidates
packet pointers when processing helper function calls, and does not traverse global sub-programs when
processing calls to global sub-programs. This means that calls to helpers done from global sub-programs do
not invalidate pointers in the caller state. E.g. the program above is unsafe, but is not rejected by
verifier. This commit fixes the omission by computing field bpf_subprog_info->changes_pkt_data for each
sub-program before main verification pass. changes_pkt_data should be set if: - subprogram calls helper
for which bpf_helper_changes_pkt_data returns true; - subprogram calls a global function, for which
bpf_subprog_info->changes_pkt_data should be set. The verifier.c:check_cfg() pass is modified to compute
this information. The commit relies on depth first instruction traversal done by check_cfg() and absence
of recursive function calls: - check_cfg() would eventually visit every call to subprogram S in a state
when S is fully explored; - when S is fully explored: - every direct helper call within S is explored (and
thus changes_pkt_data is set if needed); - every call to subprogram S1 called by S was visited with S1
fully explored (and thus S inherits changes_pkt_data from S1). The downside of such approach is that dead
code elimination is not taken into account: if a helper call inside global function is dead because of
current configuration, verifier would conservatively assume that the call occurs for the purpose of the
changes_pkt_data computation. (CVE-2024-58098)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.263.49 or later.

Plugin Details

Severity: Medium

ID: 472406

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-58098

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/5/2025

Reference Information

CVE: CVE-2024-58098

Detections

Analytics