In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Preserve inner map identity in callback frames<\/p>\n
Callback frame constructors initialize map-typed argument registers with
\n__mark_reg_known_zero() and then restore map_ptr. This clears map_uid,
\nwhich is the only field distinguishing inner maps that share an
\ninner_map_meta template.<\/p>\n
When a timer callback invokes bpf_for_each_map_elem() on a second inner
\nmap, both the saved first map and the second map value can reach the nested
\ncallback as the same template with map_uid zero. bpf_timer_init() then
\naccepts pairing the timer from the second map with the first map.<\/p>\n
The runtime records the first map in the timer without taking a reference.
\nFreeing that map does not find the timer stored in the second map, so a
\nlater timer callback dereferences the freed map.<\/p>\n
Copy map_uid from the same caller register as map_ptr when constructing
\nfor-each, timer\/workqueue, and task-work callback arguments. The existing
\nidentity check can then reject mismatched inner maps while allowing a
\ncallback value to be paired with its actual map.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Preserve inner map identity in callback frames<\/p>\n
Callback frame constructors initialize map-typed argument registers with
\n__mar<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29188","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}