In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject negative const offsets for buffer pointers<\/p>\n
The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF
\naccesses, but it currently accepts a constant negative offset produced by
\npointer arithmetic.<\/p>\n
Commit 022ac0750883 (“bpf: use reg->var_off instead of reg->off for
\npointers”) moved constant pointer offsets from reg->off to reg->var_off.
\nHowever, __check_buffer_access() continued to check only the instruction
\noffset. An access with reg->var_off equal to -8 and an instruction offset
\nof zero therefore passes verification.<\/p>\n
For writable raw tracepoints, the access end is also calculated from the
\nunsigned reg->var_off.value. An eight-byte access starting at -8 wraps
\nthe calculated end to zero, allowing the program to load and attach
\nwithout increasing max_tp_access.<\/p>\n
After ensuring that reg->var_off is constant, calculate the effective
\naccess start using signed arithmetic and reject it when it is negative.
\nUse the validated start to calculate the access end for both
\nPTR_TO_TP_BUFFER and PTR_TO_BUF.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject negative const offsets for buffer pointers<\/p>\n
The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF
\na<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6714","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}