In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: NUL-terminate replaced sysctl value<\/p>\n
When writing to sysctls, proc_sys_call_handler() guarantees that the
\nbuffer passed to proc handlers is NUL-terminated. If
\nbpf_sysctl_set_new_value() replaces the pending sysctl value, it can
\nhand a replacement buffer directly to proc handlers. However, the
\nhelper currently copies only buf_len bytes into that buffer without
\nappending a NUL terminator, leaving downstream parsers vulnerable to
\nout-of-bounds access.<\/p>\n
Fix this by appending a ” after the replaced value to restore the
\nexpected sysctl semantics. Since the helper already rejects buf_len
\ngreater than PAGE_SIZE – 1, there is always room for the extra byte.<\/p>\n
Reproduced in a QEMU x86_64 guest booted with KASAN while exercising
\nthe sysctl replacement path with a cgroup\/sysctl BPF program. The
\nreproducer targets `\/proc\/sys\/net\/core\/flow_limit_cpu_bitmap`, fills
\nthe original user write buffer with non-zero bytes, and overrides the
\nsysctl value so the replacement buffer lacks a terminating NUL. Under
\nthat setup, the pre-fix kernel reported:<\/p>\n
BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72\/0x90
\n Read of size 1 at addr ffff88800de57000 by task repro_patch3\/66
\n CPU: 0 UID: 0 PID: 66 Comm: repro_patch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy)
\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04\/01\/2014
\n Call Trace:<\/p>\n
dump_stack_lvl+0x68\/0xa0
\n print_report+0xcb\/0x5e0
\n ? __virt_addr_valid+0x21d\/0x3f0
\n ? strnchrnul+0x72\/0x90
\n ? strnchrnul+0x72\/0x90
\n kasan_report+0xca\/0x100
\n ? strnchrnul+0x72\/0x90
\n strnchrnul+0x72\/0x90
\n bitmap_parse+0x37\/0x2e0
\n flow_limit_cpu_sysctl+0xc6\/0x840
\n ? __pfx_flow_limit_cpu_sysctl+0x10\/0x10
\n ? __kvmalloc_node_noprof+0x5ba\/0x870
\n proc_sys_call_handler+0x31d\/0x480
\n ? __pfx_proc_sys_call_handler+0x10\/0x10
\n ? selinux_file_permission+0x39f\/0x500
\n ? lock_is_held_type+0x9e\/0x120
\n vfs_write+0x98e\/0x1000
\n …<\/p>\n
The buggy address is located 0 bytes to the right of
\n allocated 4096-byte region [ffff88800de56000, ffff88800de57000)
\nWith this fix applied, rerunning the same sysctl-targeted path yields
\nno corresponding KASAN reports.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: NUL-terminate replaced sysctl value<\/p>\n
When writing to sysctls, proc_sys_call_handler() guarantees that the
\nbuffer passed to pro<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28667","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28667","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28667"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28667"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28667"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}