In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Mark the zero register precise for a register-form NULL check<\/p>\n
check_cond_jmp_op() accepts “if rA rB” as a NULL check for a
\nnullable pointer rA when rB is a scalar known to be zero,
\nlifts PTR_MAYBE_NULL from rA in the corresponding branch and does not
\nmark rB precise. Consider the following program:<\/p>\n
r0 = bpf_get_prandom_u32();
\n r6 = 1; \/* the r6 == 0 path is explored first *\/
\n if (r0 == 0) goto 1f;
\n r6 = 0;
\n1:
\n r0 = bpf_map_lookup_elem(map, &0); \/* absent, NULL at runtime *\/
\n if (r0 == r6) goto 2f; \/* taken as a NULL check for r0 *\/
\n *(u8 *)(r0 + 0); \/* verifier: map value; runtime: zero *\/
\n2:
\n return 0;<\/p>\n
The r6 == 0 path is explored first and the dereference is accepted.
\nThe r6 == 1 path is pruned at the checkpoint recorded for (1),
\nso the comparison is never verified with a non-zero r6. At runtime a
\nfailed lookup returns NULL, NULL != 1 takes the non-NULL edge and the
\nprogram dereferences a pointer that is zero.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Mark the zero register precise for a register-form NULL check<\/p>\n
check_cond_jmp_op() accepts “if rA rB” as a NULL check for a
\nn<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29195","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29195"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}