In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux<\/p>\n
bpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the
\nbpf_verifier_lock, but publishes the result through a plain store
\nand re-checks it through a plain lockless load. Nothing orders
\nthe stores initializing the struct btf inside btf_parse_vmlinux()
\nagainst the store publishing the pointer: On a weakly ordered
\narch, a concurrent first-time caller taking the lockless fast
\npath could in principle observe the pointer before the parsed
\ncontents are visible. The mutex_unlock() does not help such a
\nreader given it only synchronizes with a later acquisition of the
\nsame lock. Thus, publish the pointer with smp_store_release()
\nand read it on the fast path with smp_load_acquire().<\/p>\n
Acquire semantics are needed rather than a dependency-ordered
\nREAD_ONCE(): btf_parse_vmlinux() also populates globals outside
\nthe returned object (e.g. bpf_ctx_convert.t). An address
\ndependency would only order accesses performed through the
\npointer and not cover other globals.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux<\/p>\n
bpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the
\nbpf_verifier_l<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25995","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}