In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix out-of-bounds read of rtt_min in sock_ops<\/p>\n
A sockops prog reading skops->rtt_min never checks the sk type: on the
\ntcp_conn_request() path sock_ops->sk is a request_sock (non-full), and the
\nctx rewrite casts it to a tcp_sock (full) and reads rtt_min past the end of
\nthe request_sock, returning dirty adjacent memory.<\/p>\n
\tSEC(“sockops”)
\n\tint prog(struct bpf_sock_ops *skops)
\n\t{
\n\t\tswitch (skops->op) {
\n\t\tcase BPF_SOCK_OPS_RWND_INIT:
\n\t\t\tleak = skops->rtt_min; \/* reads the request_sock OOB *\/
\n\t\t…
\n\t\t}
\n\t}<\/p>\n
For instance one such read returned rtt_min=0xffff8881, the high half of a
\nleaked kernel pointer.<\/p>\n
Guarding that cast is exactly what SOCK_OPS_GET_FIELD() does — it checks
\nis_locked_tcp_sock and returns 0 when sock_ops->sk is not a locked full
\nsocket. Every other tcp_sock field in sock_ops goes through it; rtt_min is
\nthe only one open-coded, so it skips the check.<\/p>\n
Read rtt_min through SOCK_OPS_GET_FIELD() too. rtt_min is a bit special:
\nit is a struct minmax and we only want the current min, so pass
\nrtt_min.s[0].v. That is equivalent to the old hand-computed offset<\/p>\n
\toffsetof(struct tcp_sock, rtt_min) + sizeof_field(struct minmax_sample, t)<\/p>\n
(s[0] sits at rtt_min + 0 and .v at + sizeof(.t), i.e. what minmax_get()
\nreturns), so the loaded field is unchanged and only the full-sock guard is
\nadded. The two BUILD_BUG_ON()s that protected the hand-computed offset
\nare no longer needed.<\/p>\n
Before patch:<\/p>\n
\t0: r1 = *(u64 *)(r1 +0) ; r1 = skops->sk
\n\t1: r1 = *(u32 *)(r1 +2324) ; ((tcp_sock *)sk)->rtt_min.s[0].v<\/p>\n
After patch:<\/p>\n
\t0: *(u64 *)(r1 +56) = r9
\n\t1: r9 = *(u8 *)(r1 +50) ; is_locked_tcp_sock
\n\t2: if r9 == 0 goto pc+4 ; not a locked full sock -> 0
\n\t3: r9 = *(u64 *)(r1 +56)
\n\t4: r1 = *(u64 *)(r1 +0) ; r1 = skops->sk
\n\t5: r1 = *(u32 *)(r1 +2324) ; rtt_min.s[0].v
\n\t6: goto pc+2
\n\t7: r9 = *(u64 *)(r1 +56)
\n\t8: r1 = 0<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix out-of-bounds read of rtt_min in sock_ops<\/p>\n
A sockops prog reading skops->rtt_min never checks the sk type: on the
\ntcp_conn<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41115","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41115","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41115"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41115"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}