bpf: Reject legacy packet loads from callbacks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.114, 6.18.53, 5.11, 5.16, 6.2, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 8674e2db06cff6b50f2216eed9a761d15425bb34 · fixed in cebda2a2bb4183550eae9dcf888c16407b4fffda; From ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 · fixed in 3484a99303912db62428494a9061212049027e57; From ee861486e377edc55361c08dcbceab3f6b6577bd · fixed in bc489c0c9b8c86bd7fac42cfd1bb152f042fca56; From ee861486e377edc55361c08dcbceab3f6b6577bd · fixed in e7d28823c662128caae63f14e16bd394916c139b; From 6.12.101 · fixed in 6.12.114; From 6.18.42 · fixed in 6.18.53; From 5.10.265 · fixed in 5.11; From 5.15.216 · fixed in 5.16; From 6.1.183 · fixed in 6.2; From 6.6.148 · fixed in 6.7; From 7.0.10 · fixed in 7.1
- Linux Linux
7.1
- KernelLinux
fixed in 6.12.114; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.2.7