In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject dev-bound-only programs on other devices<\/p>\n
__bpf_offload_dev_match() falls back to comparing offdev pointers after an
\nexact netdev mismatch. Bound-only programs normally have NULL offdevs, so
\nunrelated netdevs compare equal. A bound-only program on an
\noffload-registered netdev can instead inherit a real offdev and match a
\nsibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use
\nbpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs
\nspecialized for the bound driver on the target driver’s xdp_buff. Running a
\nveth-bound program on tun reads beyond tun’s bare stack xdp_buff as a
\nveth_xdp_buff.<\/p>\n
Oops: general protection fault, probably for non-canonical address
\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
\n RIP: 0010:veth_xdp_rx_timestamp (drivers\/net\/veth.c:1673)
\n Call Trace:
\n …
\n tun_build_skb (drivers\/net\/tun.c:1739)
\n tun_get_user (drivers\/net\/tun.c:1856)
\n tun_chr_write_iter (drivers\/net\/tun.c:2091)
\n vfs_write (fs\/read_write.c:595 fs\/read_write.c:687)
\n ksys_write (fs\/read_write.c:739)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:84)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)
\n Kernel panic – not syncing: Fatal exception in interrupt<\/p>\n
Restrict non-offloaded programs to exact netdev matches and retain the
\nshared-offdev fallback only for genuinely offloaded multi-port programs.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject dev-bound-only programs on other devices<\/p>\n
__bpf_offload_dev_match() falls back to comparing offdev pointers after an
\nex<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-34945","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/34945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}