Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code: if (exact != NOT_EXACT && old->stack[spi].slot_type[i % BPF_REG_SIZE] != cur->stack[spi].slot_type[i % BPF_REG_SIZE]) return false; The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen. To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ab470fefce2837e66b771c60858118d50bb5bb10 to < 7cad3174cc79519bf5f6c4441780264416822c08affected2793a8b015f7f1caadb9bce9c63dc659f7522676 to < 6e3987ac310c74bb4dd6a2fa8e46702fe505fb2baffected2793a8b015f7f1caadb9bce9c63dc659f7522676 to < bed2eb964c70b780fb55925892a74f26cb590b25affected6.6.15 to < 6.6.48affected
Linux Linux
Default version status: affected
6.7affected0 to < 6.7unaffected6.6.48 to ≤ 6.6.*unaffected6.10.7 to ≤ 6.10.*unaffected6.11 to ≤ *unaffected