In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Copy per-CPU map value padding in copy_map_value_long()<\/p>\n
In kernel, per-CPU map elements are stored with
\nround_up(map->value_size, 8) bytes. On UAPI lookup paths, it copies the
\nrounded size for each CPU into a temporary buffer.<\/p>\n
However, copy_map_value_long() passes ‘map->value_size’ to
\nbpf_obj_memcpy(). When the map has special fields, bpf_obj_memcpy() copies
\naround those fields with memcpy(), and does not copy the tail padding
\nbetween ‘map->value_size’ and round_up(map->value_size, 8).<\/p>\n
The temporary UAPI lookup buffers are allocated without __GFP_ZERO. As a
\nresult, when the per-CPU map’s value size is not equal to
\nround_up(map->value_size, 8), UAPI LOOKUP_ELEM and its variants can return
\nstale heap contents from that padding to user space. The same issue
\napplies to bpf_iter for per-CPU maps.<\/p>\n
Pass round_up(map->value_size, 8) to bpf_obj_memcpy() from
\ncopy_map_value_long(), so per-CPU maps both with and without special
\nfields copy the entire per-CPU slot. Remove the now redundant round_up()
\nfrom bpf_obj_memcpy()’s long_memcpy path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Copy per-CPU map value padding in copy_map_value_long()<\/p>\n
In kernel, per-CPU map elements are stored with
\nround_up(map->value_s<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26031","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}