In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: reject BPF_PSEUDO_FUNC reference to the main program<\/p>\n
fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real
\nfunction addresses. This function is invoked from bpf_jit_subprogs()
\nonly when env->subprog_cnt > 1. Meaning that for any program like
\nbelow:<\/p>\n
int main(void *ctx) {
\n void *ptr = main;
\n …
\n bpf_timer_set_callback(…, ptr);
\n …
\n }<\/p>\n
The ‘ptr’ won’t be ever converted to contain an address.
\nIn combination with e.g. bpf_timer_set_callback() this would lead to a
\nfunction call at a bogus address.<\/p>\n
Instead of complicating the implementation, just assume that no useful
\nprogram needs main to be a sync or async callback and reject
\nBPF_PSEUDO_FUNC loads for the main subprogram.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: reject BPF_PSEUDO_FUNC reference to the main program<\/p>\n
fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real
\nf<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29230","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29230","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29230"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29230"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}