In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix NULL-ptr-deref when showing a void BTF type<\/p>\n
btf_modifier_show() resolves the modifier and then calls
\nbtf_type_ops(t)->show() unconditionally. For the void type (type_id 0,
\nBTF_KIND_UNKN) kind_ops[] has no entry, so ->show is NULL.<\/p>\n
A “const void” (a modifier resolving to void) cannot be a map key or
\nvalue – map_check_btf() rejects it because void has no size – so the map
\ndump path does not reach it. But bpf_snprintf_btf() takes a type_id
\nstraight from the BPF program, and passing such a “const void” from the
\nvmlinux BTF NULL-derefs:<\/p>\n
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
\nRIP: 0010:btf_modifier_show (kernel\/bpf\/btf.c:2914)
\nCall Trace:<\/p>\n
btf_type_show (kernel\/bpf\/btf.c:8251)
\n btf_type_snprintf_show (kernel\/bpf\/btf.c:8321)
\n bpf_snprintf_btf (kernel\/trace\/bpf_trace.c:1047)
\n bpf_prog_test_run_raw_tp (net\/bpf\/test_run.c:829)
\n __sys_bpf (kernel\/bpf\/syscall.c:4804)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:94)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n
Fall back to btf_df_show() when the resolved type has no show op; it
\nemits the “” placeholder already used for kinds like
\nFWD and FUNC. bpf_snprintf_btf() then returns the length as usual.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix NULL-ptr-deref when showing a void BTF type<\/p>\n
btf_modifier_show() resolves the modifier and then calls
\nbtf_type_ops(t)->sho<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29219","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}