bpf: Reject non-scalar bpf_loop iteration counts
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.158, 6.12.111, 6.18.53, 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From bfc5c19b4b48840627af0d0f1c8f4461b276e508 · fixed in 2ff38b3552af53238aee6c877ae64cc798d46fce; From bb124da69c47dd98d69361ec13244ece50bec63e · fixed in 656d40d1ca228ee21a9b3280432479fc9eae75ab; From bb124da69c47dd98d69361ec13244ece50bec63e · fixed in e2e1161e03fecff6d2229a81b024337144bfcd97; From bb124da69c47dd98d69361ec13244ece50bec63e · fixed in f8ae8275c721334ee50fafdd986fb83294eb941a; From bb124da69c47dd98d69361ec13244ece50bec63e · fixed in c3fd8e5fd100f122bad503bdc0e9277219533253; From 6.6.15 · fixed in 6.6.158
- Linux Linux
6.7
- KernelLinux
fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; fixed in 6.18.53; From 6.13.0 · fixed in 7.2.7