In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat<\/p>\n
BPF_PROG_QUERY writes back the ‘query.revision’ field unconditionally to
\nuserspace. If userspace passes a smaller ‘bpf_attr’ structure (e.g. 40
\nbytes, which was the layout before the addition of ‘query.revision’),
\nthe kernel performs an out-of-bounds write.<\/p>\n
Fix this by propagating the user-provided attribute size ‘uattr_size’
\ndown to the cgroup query handlers, and conditionally skipping writing
\nthe revision field to userspace when the provided buffer size is
\ninsufficient.<\/p>\n
query.revision in bpf_mprog_query is structurally identical to the
\ncgroup case: a late tail field, written unconditionally.<\/p>\n
But the backward-compat hazard is not the same.<\/p>\n
The min-historical-size test is per command, and bpf_mprog_query only
\nserves attach types that were born with revision in the struct:<\/p>\n
– tcx_prog_query -> BPF_TCX_INGRESS\/EGRESS
\n– netkit_prog_query -> BPF_NETKIT_PRIMARY\/PEER<\/p>\n
tcx, netkit, the revision field, and bpf_mprog_query itself all landed in
\nthe same v6.6 merge window (053c8e1f235d added the mprog query API +
\nrevision; tcx in e420bed02507, netkit in 35dfaad7188c). There has never
\nbeen a tcx\/netkit BPF_PROG_QUERY userspace that doesn’t know about
\nrevision. So for these commands the minimum legitimate struct already
\ncovers offset 56-64 \u2014 no old binary can be broken here.<\/p>\n
Contrast with cgroup: BPF_PROG_QUERY on cgroup attach types shipped in
\n2017; revision write-back was bolted on years later (120933984460). That
\npath has a real population of pre-revision callers.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat<\/p>\n
BPF_PROG_QUERY writes back the ‘query.revision’ field unconditionally<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7322","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}