In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Check load-acquire src ptr type before the load<\/p>\n
check_atomic_load() calls check_load_mem() before atomic_ptr_type_ok().
\nFor a load-acquire that fetches into its own source register (dst_reg ==
\nsrc_reg), check_load_mem() overwrites src_reg’s type with the type of the
\nloaded value, so the subsequent atomic_ptr_type_ok() no longer sees the
\nsource pointer and fails to reject the disallowed types (ctx, pkt,
\nflow_keys, sock).<\/p>\n
Since bpf_convert_ctx_accesses() does not rewrite atomic loads, the raw
\naccess to the underlying kernel object is left in place. The destination
\ntype is taken from the ctx access itself, so a load-acquire of the sk
\nfield of struct __sk_buff for example leaves the register typed as
\nPTR_TO_SOCK_COMMON_OR_NULL, which type_is_sk_pointer() does not match
\neither, while it actually holds unconverted struct sk_buff bytes. Once
\nthe NULL check has passed this is a type confusion, not just a leak of
\nkernel data.<\/p>\n
Validate src_reg with check_reg_arg() and check the source pointer type
\nwith atomic_ptr_type_ok() before the load again, mirroring
\ncheck_atomic_rmw(). Out-of-range register numbers are already rejected
\nearlier by check_and_resolve_insns() (commit 503d21ef8eac (“bpf: Do
\nregister range validation early”)), and the only exemption there,
\nis_stack_arg_ldx(), requires BPF_LDX | BPF_MEM | BPF_DW and thus never
\nmatches a BPF_ATOMIC insn. atomic_ptr_type_ok() can therefore not
\ndereference register state out of bounds, that is, the out-of-bounds
\nread addressed by the Fixes commit below does not reappear (as proven
\nalso via selftest).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Check load-acquire src ptr type before the load<\/p>\n
check_atomic_load() calls check_load_mem() before atomic_ptr_type_ok().
\nFor a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25721","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}