In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix divide-by-zero in btf_struct_walk()<\/p>\n
When an access goes past the struct and the last member is a flexible
\narray, btf_struct_walk() folds the offset back into a single element with
\n(off – moff) % t->size, but never checks that the element type has a size.<\/p>\n
BTF takes an empty struct, so this in program BTF<\/p>\n
\t\/* event could be empty *\/
\n\tstruct event {
\n #ifdef HAVE_TIMESTAMP
\n\t\t__u64 ts;
\n #endif
\n\t};<\/p>\n
\tstruct batch {
\n\t\tint nr;
\n\t\tstruct event events[];
\n\t};<\/p>\n
divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that
\nis not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a
\nsleepable program.<\/p>\n
Oops: divide error: 0000 [#1] SMP KASAN PTI
\nRIP: 0010:btf_struct_walk+0x53f\/0x1570
\nCall Trace:<\/p>\n
btf_struct_access+0x42a\/0xcd0
\n check_ptr_to_btf_access+0x4dc\/0x1160
\n check_mem_access+0x3a45\/0x8740
\n check_load_mem+0x36a\/0xd10
\n do_check_common+0x3ef0\/0xb210
\n bpf_check+0x6d3b\/0x8580
\n bpf_prog_load+0xf7c\/0x2720
\n __sys_bpf+0xa83\/0x3690
\n __x64_sys_bpf+0xc7\/0x150
\n x64_sys_call+0x1f3f\/0x27e0
\n do_syscall_64+0xe5\/0x610
\n entry_SYSCALL_64_after_hwframe+0x76\/0x7e<\/p>\n
Reject a zero-sized element type. The fixed array path in the same function
\nalready bails out on the same thing:<\/p>\n
\tbtf_struct_walk()
\n\t…
\n\t\t\/* skip empty array *\/
\n\t\tif (moff == mtrue_end)
\n\t\t\tcontinue;<\/p>\n
\t\tmsize \/= total_nelems;<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix divide-by-zero in btf_struct_walk()<\/p>\n
When an access goes past the struct and the last member is a flexible
\narray, btf_stru<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41119","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}