Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never returns NULL -- when the current element is the last entry it wraps to the list head via container_of(). The subsequent NULL check is therefore dead code and get_next_key() never returns -ENOENT for the last element, instead reading storage->key from a bogus pointer that aliases internal map fields and copying the result to userspace. Replace it with list_entry_is_head() so the function correctly returns -ENOENT when there are no more entries.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected de9cbbaadba5adf88a19e46df61f7054000838f6 before 0f3d9dd5e1fd52b39e25328307c6a694e994ffe3; affected de9cbbaadba5adf88a19e46df61f7054000838f6 before 26d3339e465e54107bd85884341d1609c5300d6a; affected de9cbbaadba5adf88a19e46df61f7054000838f6 before 2c88b2d96e1d4d0c7c4589a4593d4cdee6d332d6; affected de9cbbaadba5adf88a19e46df61f7054000838f6 before b4b5a20bed82130da2f2818f04d52378952fbd0b; affected de9cbbaadba5adf88a19e46df61f7054000838f6 before 85a2f30e40f7468db732f55659bc6318874f49af; affected de9cbbaadba5adf88a19e46df61f7054000838f6 before 32ce55d424395904986f5066f8755f6cb9993377; affected de9cbbaadba5adf88a19e46df61f7054000838f6 before fc39753b7f92e09177777e9c648afe5aa3abb81f; affected de9cbbaadba5adf88a19e46df61f7054000838f6 before 5828b9e5b272ecff7cf5d345128d3de7324117f7 |
| Linux / Linux | affected 4.19; unaffected 0 before 4.19; unaffected 5.10.258 through 5.10.*; unaffected 5.15.209 through 5.15.*; unaffected 6.1.175 through 6.1.*; unaffected 6.6.141 through 6.6.*; unaffected 6.12.91 through 6.12.*; unaffected 6.18.33 through 6.18.*; unaffected 7.0.10 through 7.0.*; unaffected 7.1 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/0f3d9dd5e1fd52b39e25328307c6a694e994ffe3
- https://git.kernel.org/stable/c/26d3339e465e54107bd85884341d1609c5300d6a
- https://git.kernel.org/stable/c/2c88b2d96e1d4d0c7c4589a4593d4cdee6d332d6
- https://git.kernel.org/stable/c/b4b5a20bed82130da2f2818f04d52378952fbd0b
- https://git.kernel.org/stable/c/85a2f30e40f7468db732f55659bc6318874f49af
- https://git.kernel.org/stable/c/32ce55d424395904986f5066f8755f6cb9993377
- https://git.kernel.org/stable/c/fc39753b7f92e09177777e9c648afe5aa3abb81f
- https://git.kernel.org/stable/c/5828b9e5b272ecff7cf5d345128d3de7324117f7
ADP enrichment
No English description supplied.