Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code: if (exact != NOT_EXACT && old->stack[spi].slot_type[i % BPF_REG_SIZE] != cur->stack[spi].slot_type[i % BPF_REG_SIZE]) return false; The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen. To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected ab470fefce2837e66b771c60858118d50bb5bb10 before 7cad3174cc79519bf5f6c4441780264416822c08; affected 2793a8b015f7f1caadb9bce9c63dc659f7522676 before 6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b; affected 2793a8b015f7f1caadb9bce9c63dc659f7522676 before bed2eb964c70b780fb55925892a74f26cb590b25; affected 6.6.15 before 6.6.48 |
| Linux / Linux | affected 6.7; unaffected 0 before 6.7; unaffected 6.6.48 through 6.6.*; unaffected 6.10.7 through 6.10.*; unaffected 6.11 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08
- https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b
- https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25
ADP enrichment
No English description supplied.
No references supplied.