bpf: check changes_pkt_data property for extension programs
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.90, 6.12.25
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: check changes_pkt_data property for extension programs When processing calls to global sub-programs, verifier decides whether to invalidate all packet pointers in current state depending on the changes_pkt_data property of the global sub-program. Because of this, an extension program replacing a global sub-program must be compatible with changes_pkt_data property of the sub-program being replaced. This commit: • adds changes_pkt_data flag to struct bpf_prog_aux: • this flag is set in check_cfg() for main sub-program; • in jit_subprogs() for other sub-programs; • modifies bpf_check_attach_btf_id() to check changes_pkt_data flag; • moves call to check_attach_btf_id() after the call to check_cfg(), because it needs changes_pkt_data flag to be set: bpf_check: ... ... • check_attach_btf_id resolve_pseudo_ldimm64 resolve_pseudo_ldimm64 --> bpf_prog_is_offloaded bpf_prog_is_offloaded check_cfg check_cfg + check_attach_btf_id ... ... The following fields are set by check_attach_btf_id(): • env->ops • prog->aux->attach_btf_trace • prog->aux->attach_func_name • prog->aux->attach_func_proto • prog->aux->dst_trampoline • prog->aux->mod • prog->aux->saved_dst_attach_type • prog->aux->saved_dst_prog_type • prog->expected_attach_type Neither of these fields are used by resolve_pseudo_ldimm64() or bpf_prog_offload_verifier_prep() (for netronome and netdevsim drivers), so the reordering is safe.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From be8704ff07d2374bcc5c675526f95e70c6459683 · fixed in 7197fc4acdf238ec8ad06de5a8235df0c1f9c7d7; From be8704ff07d2374bcc5c675526f95e70c6459683 · fixed in 3846e2bea565ee1c5195dcc625fda9868fb0e3b3; From be8704ff07d2374bcc5c675526f95e70c6459683 · fixed in 81f6d0530ba031b5f038a091619bf2ff29568852
- Linux Linux
5.6
- KernelLinux
From 5.6.0 · fixed in 6.6.90; From 6.7.0 · fixed in 6.12.25