In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io_uring\/bpf-ops: reject re-registration of an already-bound ops<\/p>\n
io_install_bpf() only rejects a second registration on the ctx side
\n(ctx->bpf_ops) and sets the per-map back-pointer ops->priv
\nunconditionally. The struct_ops link path never advances a map past
\nBPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be
\nregistered more than once, and bpf_io_reg() re-resolves the target ring
\nvia fget(ops->ring_fd) on every call. A caller can therefore point the
\nsame ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE
\ncalls.<\/p>\n
The second registration passes the ctx->bpf_ops check (the new ctx has
\nnone) and overwrites ops->priv, orphaning the first ctx. Teardown
\n(io_eject_bpf()\/bpf_io_unreg()) only reaches a ctx through ops->priv, so
\nthe orphaned ctx is never torn down: its ctx->loop_step keeps pointing
\ninto the struct_ops trampoline, which is freed once the map is gone. A
\nlater io_uring_enter() on the orphaned ring then calls the dangling
\nctx->loop_step from io_run_loop() — a use-after-free of freed
\nexecutable memory, reachable by a task with CAP_BPF + CAP_PERFMON.<\/p>\n
Reject registration when ops->priv is already set, as hid_bpf_reg()
\ndoes for its struct_ops.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io_uring\/bpf-ops: reject re-registration of an already-bound ops<\/p>\n
io_install_bpf() only rejects a second registration on the ctx si<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6780","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6780","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6780"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6780"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6780"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}