Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type. The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected d503a04f8bc0c75dc9db9452d8cc79d748afb752 before b14dabe9656c1029abf3aa01e69c0d62f37f2f88; affected d503a04f8bc0c75dc9db9452d8cc79d748afb752 before d4ba9d888ac0a8f12c78071fff73e1205a0b9293; affected d503a04f8bc0c75dc9db9452d8cc79d748afb752 before eb287c6e81dedef92da01eb947f380d0aae513c3; affected d503a04f8bc0c75dc9db9452d8cc79d748afb752 before 4bc49ae344d65cfcef738f281ac575cf73ca2fc5 |
| Linux / Linux | affected 6.10; unaffected 0 before 6.10; unaffected 6.12.114 through 6.12.*; unaffected 6.18.57 through 6.18.*; unaffected 7.2.6 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.