bpf, x86: Fix trampoline stack size for 128-bit arguments
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.110, 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots. Compute the register count from arg_size for all arguments to fix it.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 · fixed in 7f96bf0d24b2acc0732906b60a10f06783f2470d; From a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 · fixed in 4aed2346fa9b88d458eeb8c01123f3c07585a675; From a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 · fixed in 40f3bfbbb222b92278f3797614b70f68d46824ac; From a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 · fixed in a6d7d7a253c550e74b0651897fe313c2f9b2301f; From a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 · fixed in 814cba835ef648e0c5eb79505c96c0493b29eea6
- Linux Linux
6.1
- KernelLinux
From 6.1.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6