[AUTO-CHERRYPICK] [Low] patch bpftrace for CVE-2024-2313 - branch main (#13353)

Co-authored-by: jykanase <v-jykanase@microsoft.com>

Author: CBL-Mariner-Bot

SPECS/bpftrace/CVE-2024-2313.patch

@@ -0,0 +1,90 @@
+From 69d9bf472c805beb9c2b32e949e83be1c6f05b39 Mon Sep 17 00:00:00 2001
+From: jykanase <v-jykanase@microsoft.com>
+Date: Mon, 17 Mar 2025 14:13:26 +0000
+Subject: [PATCH] CVE-2024-2313
+Source Link : https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998
+---
+ src/utils.cpp | 27 +++++++++++++++++++++++----
+ src/utils.h   |  1 +
+ 2 files changed, 24 insertions(+), 4 deletions(-)
+
+diff --git a/src/utils.cpp b/src/utils.cpp
+index 426644e..31e666f 100644
+--- a/src/utils.cpp
++++ b/src/utils.cpp
+@@ -110,7 +110,9 @@ const struct vmlinux_location vmlinux_locs[] = {
+   { "/usr/lib/debug/lib/modules/%1$s/vmlinux", false },
+   { nullptr, false },
+ };
+-
++constexpr std::string_view PROC_KHEADERS_PATH = "/sys/kernel/kheaders.tar.xz";
++ 
++ 
+ static bool pid_in_different_mountns(int pid);
+ static std::vector<std::string>
+ resolve_binary_path(const std::string &cmd, const char *env_paths, int pid);
+@@ -503,6 +505,20 @@ bool is_dir(const std::string& path)
+   return std_filesystem::is_directory(buf, ec);
+ }
+ 
++bool file_exists_and_ownedby_root(const char *f)
++ {
++   struct stat st;
++   if (stat(f, &st) == 0) {
++     if (st.st_uid != 0) {
++       LOG(ERROR) << "header file ownership expected to be root: "
++                  << std::string(f);
++       return false;
++     }
++     return true;
++   }
++   return false;
++ }
++ 
+ namespace {
+   struct KernelHeaderTmpDir {
+     KernelHeaderTmpDir(const std::string& prefix) : path{prefix + "XXXXXX"}
+@@ -535,14 +551,14 @@ namespace {
+   {
+     std::error_code ec;
+     std_filesystem::path path_prefix{ "/tmp" };
+-    std_filesystem::path path_kheaders{ "/sys/kernel/kheaders.tar.xz" };
++    std_filesystem::path path_kheaders{ PROC_KHEADERS_PATH };
+     if (const char* tmpdir = ::getenv("TMPDIR")) {
+       path_prefix = tmpdir;
+     }
+     path_prefix /= "kheaders-";
+     std_filesystem::path shared_path{ path_prefix.string() + utsname.release };
+ 
+-    if (std_filesystem::exists(shared_path, ec))
++    if (file_exists_and_ownedby_root(shared_path.c_str()))
+     {
+       // already unpacked
+       return shared_path.string();
+@@ -566,7 +582,10 @@ namespace {
+ 
+     KernelHeaderTmpDir tmpdir{path_prefix};
+ 
+-    FILE* tar = ::popen(("tar xf /sys/kernel/kheaders.tar.xz -C " + tmpdir.path).c_str(), "w");
++    FILE *tar = ::popen(("tar xf " + std::string(PROC_KHEADERS_PATH) + " -C " +
++                        tmpdir.path)
++                           .c_str(),
++                       "w");
+     if (!tar) {
+       return "";
+     }
+diff --git a/src/utils.h b/src/utils.h
+index 9b96be9..103af0d 100644
+--- a/src/utils.h
++++ b/src/utils.h
+@@ -156,6 +156,7 @@ std::vector<std::string> get_wildcard_tokens(const std::string &input,
+ std::vector<int> get_online_cpus();
+ std::vector<int> get_possible_cpus();
+ bool is_dir(const std::string &path);
++bool file_exists_and_ownedby_root(const char *f);
+ std::tuple<std::string, std::string> get_kernel_dirs(
+     const struct utsname &utsname,
+     bool unpack_kheaders);
+-- 
+2.45.2
+

SPECS/bpftrace/bpftrace.spec

@@ -1,13 +1,14 @@
 Summary:        Berkeley Packet Filter Tracing Language
 Name:           bpftrace
 Version:        0.16.0
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
 Group:          Applications/System
 URL:            https://github.com/iovisor/bpftrace
 Source0:        %{url}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
+Patch0:         CVE-2024-2313.patch
 BuildRequires:  bcc-devel
 BuildRequires:  binutils-devel
 BuildRequires:  bison
@@ -78,6 +79,9 @@ install -p -m 644 tools/*.txt %{buildroot}%{_datadir}/bpftrace/tools/doc
 %{_datadir}/bpftrace/tools
 
 %changelog
+* Tue Mar 18 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 0.16.0-3
+- Fix CVE-2024-2313
+
 * Wed Sep 20 2023 Jon Slobodzian <joslobo@microsoft.com> - 0.16.0-2
 - Recompile with stack-protection fixed gcc version (CVE-2023-4039)