bpf: Zero queue and stack outputs on lock failure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.5, 5.11, 5.16, 6.2, 6.6, and 4 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 · fixed in a6090eeb289c5fa45f7b629befac2bd3c19a6dae; From a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 · fixed in 23b4bcc79bab5285275912b94e98c286f281de75; From a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 · fixed in 1534c4bff3aaca19c4c9a82f93e9b81f7c983de3; From a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 · fixed in e2396b8a562073787e627a5f483f1bc5c452fa6a; From a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 · fixed in 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232; From 5.4.258 · fixed in 5.5; From 5.10.198 · fixed in 5.11; From 5.15.134 · fixed in 5.16; From 6.1.56 · fixed in 6.2; From 6.5.6 · fixed in 6.6
- Linux Linux
6.6
- KernelLinux
From 6.6.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6