In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix effective prog array index with BPF_F_PREORDER<\/p>\n
replace_effective_prog() and purge_effective_progs() located the slot in
\nthe effective array by walking the program hlist and counting entries
\nlinearly. That count does not match the array layout: compute_effective_
\nprogs() places BPF_F_PREORDER programs at the front (ancestor cgroup
\nfirst, attach order within a cgroup) and the rest after them (descendant
\ncgroup first). So when a preorder program is present, the linear hlist
\nposition no longer equals the program’s index in the effective array.<\/p>\n
For replace_effective_prog() (bpf_link_update()) this overwrote the
\nwrong slot, corrupting the effective order. For purge_effective_progs(),
\nit could dummy out a slot belonging to a different program and leave the
\ndetached program in the array while bpf_prog_put() drops its reference,
\ni.e. a use-after-free.<\/p>\n
Fix both by replaying compute_effective_progs()’s placement (including
\nthe per-cgroup preorder reversal) in a shared effective_prog_pos()
\nhelper. Identify the entry by its struct bpf_prog_list pointer rather
\nthan by (prog, link) value, so the lookup resolves to exactly the
\nattachment the syscall selected even when the same bpf_prog is attached
\nto several cgroups in the hierarchy.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix effective prog array index with BPF_F_PREORDER<\/p>\n
replace_effective_prog() and purge_effective_progs() located the slot in
\nt<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7087","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}