Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers") moved constant pointer offsets from reg->off to reg->var_off. However, __check_buffer_access() continued to check only the instruction offset. An access with reg->var_off equal to -8 and an instruction offset of zero therefore passes verification. For writable raw tracepoints, the access end is also calculated from the unsigned reg->var_off.value. An eight-byte access starting at -8 wraps the calculated end to zero, allowing the program to load and attach without increasing max_tp_access. After ensuring that reg->var_off is constant, calculate the effective access start using signed arithmetic and reject it when it is negative. Use the validated start to calculate the access end for both PTR_TO_TP_BUFFER and PTR_TO_BUF.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 022ac075088366b62e130da5e1b200bc93a47191 before 314bd592085c0720ef519f6edbc5f41440ff78d4; affected 022ac075088366b62e130da5e1b200bc93a47191 before fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9 |
| Linux / Linux | affected 7.1; unaffected 0 before 7.1; unaffected 7.1.5 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.