In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Don’t infer non-NULL from a pointer with an unbounded offset<\/p>\n
reg_not_null() decides that a register holds a non-NULL value by
\nlooking at its type alone. For pointer types that allow arithmetic the
\ntype only guarantees a non-NULL base, in case of an unbound offset
\nthe runtime offset value might still add up to NULL.
\nConsider the followng program:<\/p>\n
r6 = bpf_map_lookup_elem(map, &0); \/* present *\/
\n if (r6 == 0) return 0;
\n r7 = bpf_map_lookup_elem(map, &1); \/* absent, NULL at runtime *\/
\n r8 = r7;
\n r8 -= r6; \/* pointer – pointer: unknown scalar, -r6 *\/
\n r8 <>= 1; \/* any non-negative offset is accepted by *\/
\n \/* check_reg_sane_offset_ptr() *\/
\n r6 += r8; \/* verifier: map value; runtime: zero *\/
\n if (r7 != r6) return 0;
\n *(u8 *)(r7 + 0); \/* r7 is inferred non-NULL, both are zero *\/<\/p>\n
At runtime both registers are zero, the comparison is true and the
\nload faults with NULL pointer dereference.<\/p>\n
Require the offset to be within +-BPF_MAX_VAR_OFF in reg_not_null().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Don’t infer non-NULL from a pointer with an unbounded offset<\/p>\n
reg_not_null() decides that a register holds a non-NULL value by<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29198","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}