In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: backtracking shouldn’t clear outer frame R1-R5 for callbacks<\/p>\n
When processing calls to bpf_loop() verifier marks R1 (and R4) as
\nprecise. R1 tracks loop iterations number and because of the
\n‘callback_depth < R1' mechanics in check_helper_call() must be marked
\nprecise. However, precision propagation for R1 was broken,
\nwhen bpf_loop() call was verified on a second iteration.<\/p>\n
Consider the following verification trace:
\n– main: bpf_loop(nr_loops, callback …)
\n– callback: BPF_EXIT
\n– main: bpf_loop(nr_loops, callback …)
\n– …<\/p>\n
While the first visit of the call to bpf_loop() propagated R1
\nprecision as expected, the second call to mark_chain_precision() in
\nthe check_helper_call() set R1, but it was immediately reset when
\nbacktrack_insn() processed preceding BPF_EXIT in the loop deleted in
\nthis patch.<\/p>\n
Because of that, the second visit of the call to bpf_loop() injected
\ncheckpoint with R1 not marked as precise. Which could trick the
\nverifier into accepting unsafe programs. See the next patch for an
\nexample of such program.<\/p>\n
Commit is structured in a way to minimize conflicts when
\n'bpf' would be eventually merged with 'bpf-next'.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: backtracking shouldn’t clear outer frame R1-R5 for callbacks<\/p>\n
When processing calls to bpf_loop() verifier marks R1 (and R4) a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29239","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}