Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: bpf: fix check for attempt to corrupt spilled pointer When register is spilled onto a stack as a 1/2/4-byte register, we set slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it, depending on actual spill size). So to check if some stack slot has spilled register we need to consult slot_type[7], not slot_type[0]. To avoid the need to remember and double-check this in the future, just use is_spilled_reg() helper.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected cdd73a5ed0840da88a3b9ad353f568e6f156d417 before 2757f17972d87773b3677777f5682510f13c66ef; affected 07c286c10a9cedbd71f20269ff3a4e73d9aab2fe before 67e6707f07354ed1acb4e65552e97c60cf9d69cf; affected 27113c59b6d0a587b29ae72d4ff3f832f58b0651 before fc3e3c50a0a4cac1463967c110686189e4a59104; affected 27113c59b6d0a587b29ae72d4ff3f832f58b0651 before 8dc15b0670594543c356567a1a45b0182ec63174; affected 27113c59b6d0a587b29ae72d4ff3f832f58b0651 before 40617d45ea05535105e202a8a819e388a2b1f036; affected 27113c59b6d0a587b29ae72d4ff3f832f58b0651 before ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae; affected 5.10.163 before 5.10.209; affected 5.15.86 before 5.15.148 |
| Linux / Linux | affected 5.16; unaffected 0 before 5.16; unaffected 5.10.209 through 5.10.*; unaffected 5.15.148 through 5.15.*; unaffected 6.1.75 through 6.1.*; unaffected 6.6.14 through 6.6.*; unaffected 6.7.2 through 6.7.*; unaffected 6.8 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/2757f17972d87773b3677777f5682510f13c66ef
- https://git.kernel.org/stable/c/67e6707f07354ed1acb4e65552e97c60cf9d69cf
- https://git.kernel.org/stable/c/fc3e3c50a0a4cac1463967c110686189e4a59104
- https://git.kernel.org/stable/c/8dc15b0670594543c356567a1a45b0182ec63174
- https://git.kernel.org/stable/c/40617d45ea05535105e202a8a819e388a2b1f036
- https://git.kernel.org/stable/c/ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.
- https://git.kernel.org/stable/c/2757f17972d87773b3677777f5682510f13c66ef
- https://git.kernel.org/stable/c/67e6707f07354ed1acb4e65552e97c60cf9d69cf
- https://git.kernel.org/stable/c/fc3e3c50a0a4cac1463967c110686189e4a59104
- https://git.kernel.org/stable/c/8dc15b0670594543c356567a1a45b0182ec63174
- https://git.kernel.org/stable/c/40617d45ea05535105e202a8a819e388a2b1f036
- https://git.kernel.org/stable/c/ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html