In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix percpu map update indexing with sparse CPU IDs<\/p>\n
Per-CPU array, hash, and cgroup storage map updates without BPF_F_CPU
\nor BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in
\npossible-CPU order. The buffer is sized as:<\/p>\n
round_up(value_size, 8) * num_possible_cpus()<\/p>\n
The update paths iterate over possible CPUs, but use the logical CPU ID
\nto calculate the source offset:<\/p>\n
value + size * cpu<\/p>\n
This only works when possible CPU IDs are contiguous starting at zero.<\/p>\n
For example, with a possible CPU mask of 0,2-3, the buffer contains
\nthree slots corresponding to CPUs 0, 2, and 3. CPU2 is therefore
\nexpected to use slot 1 and CPU3 slot 2. Instead, the current code uses
\nslots 2 and 3 respectively, causing incorrect per-CPU values and an
\nout-of-bounds read from the update buffer for CPU3.<\/p>\n
The corresponding lookup paths already use a dense offset while
\niterating over possible CPUs. Do the same for the array, hash, and
\ncgroup storage update paths, advancing the source offset once for each
\npossible CPU. BPF_F_ALL_CPUS continues to use the same value for every
\nCPU.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix percpu map update indexing with sparse CPU IDs<\/p>\n
Per-CPU array, hash, and cgroup storage map updates without BPF_F_CPU
\nor B<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29303","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}