In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed<\/p>\n
A potential invalid storage access issue can occur after replacing a
\ncgroup bpf prog.<\/p>\n
This occurs in the following scenario:
\n1. prog1 with storage is attached to a cgroup in multi-attach mode.
\n2. prog1 is replaced with prog2 using BPF_F_REPLACE in multi-attach
\n mode, but fails midway (e.g. in bpf_trampoline_link_cgroup_shim or
\n update_effective_progs).
\n3. A new prog3 is attached to the cgroup in multi-attach mode.<\/p>\n
The reason is that __cgroup_bpf_attach overwrites pl->storage with the
\nnew storage prior to attachment completion. When attachment fails
\nmidway, the cleanup path calls bpf_cgroup_storages_free(new_storage) to
\nfree the newly allocated storage, but fails to restore pl->storage back
\nto old_storage.<\/p>\n
Consequently, the still-active prog1 holds invalid or dangling storage
\npointers, leading to an invalid memory access when prog1 executes and
\ncalls bpf_get_local_storage. Additionally, original pl->flags and
\ncgrp->bpf.flags[atype] are left unrestored.<\/p>\n
Fix this by saving old_pl_flags, old_storage, and old_flags prior to the
\nupdate, and properly restoring all of them in the cleanup path on error.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed<\/p>\n
A potential invalid storage access issue can occur after <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25722","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}