bpf: mark a NULL call argument precise
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.114, 6.18.57, 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From b5dc0163d8fd78e64a7e21f309cf932fda34353e · fixed in febbb66e682d8328f7c5bcbdd5e4291abab2e858; From b5dc0163d8fd78e64a7e21f309cf932fda34353e · fixed in 627089c278df58749f25686c6a3caf7e181b5951; From b5dc0163d8fd78e64a7e21f309cf932fda34353e · fixed in b1fe6379e401b8ce0f561cb4d84af2b70b4343c3; From b5dc0163d8fd78e64a7e21f309cf932fda34353e · fixed in 69a9ad004ccf5d45e534c7d503f47f643abe64b7; From b5dc0163d8fd78e64a7e21f309cf932fda34353e · fixed in 1a3a10b030c96ea88868ccc060a16827c01eaa5a
- Linux Linux
5.3
- KernelLinux
From 5.3.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.7