In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: don’t downgrade half-dead scalar zero spills to STACK_ZERO<\/p>\n
states.c:__clean_func_state() can downgrade scalar zero spill to
\nSTACK_ZERO in the following case:<\/p>\n
*(u64 *)(r10 – 8) = 0;
\n … checkpoint …
\n r1 = *(u32 *)(r10 – 4);
\n … no reads from r10-8 …<\/p>\n
Here 4 bytes at r10-8 are dead and verifier changes scalar spill to a
\ncombination: 0000pppp (p stands for poison). Such a change breaks
\nprecision propagation chains. All places that produce STACK_ZERO
\nshould call bpf_mark_chain_precision() for the zero source.<\/p>\n
This patch fixes the bug in a simplest way possible:
\navoids converting stack spills of zero to STACK_ZERO.
\nTwo smarter approaches are possible:
\n– do bpf_mark_chain_precision() from __clean_func_state()
\n– check slot liveness information in check_stack_write_fixed_off()<\/p>\n
I investigated both and the changes required are a bit tricky,
\nhence go with a simple fix for the time being.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: don’t downgrade half-dead scalar zero spills to STACK_ZERO<\/p>\n
states.c:__clean_func_state() can downgrade scalar zero spill to
\nS<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29286","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29286","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29286"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29286"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}