Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_narrower_load" case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning: verifier bug: error during ctx access conversion(1) This patch fixes that to return a proper "invalid bpf_context access off=X size=Y" error on the load instruction. The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency. Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f96da09473b52c09125cc9bf7d7d4576ae8229e0 to < 7847c4140e06f6e87229faae22cc38525334c156affectedf96da09473b52c09125cc9bf7d7d4576ae8229e0 to < feae34c992eb7191862fb1594c704fbbf650fef8affectedf96da09473b52c09125cc9bf7d7d4576ae8229e0 to < 33660d44e789edb4f303210c813fc56d56377a90affectedf96da09473b52c09125cc9bf7d7d4576ae8229e0 to < e2e9599f3503df7cf3569d2b6c50d5488fb59435affectedf96da09473b52c09125cc9bf7d7d4576ae8229e0 to < 058a0da4f6d916a79b693384111bb80a90d73763affectedf96da09473b52c09125cc9bf7d7d4576ae8229e0 to < 202900ceeef67458c964c2af6e1427c8e533ea7caffectedf96da09473b52c09125cc9bf7d7d4576ae8229e0 to < e09299225d5ba3916c91ef70565f7d2187e4cca0affected
Linux Linux
Default version status: affected
4.13affected0 to < 4.13unaffected5.10.249 to ≤ 5.10.*unaffected5.15.199 to ≤ 5.15.*unaffected6.1.162 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.67 to ≤ 6.12.*unaffected6.16.1 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7847c4140e06f6e87229faae22cc38525334c156 ↗
- https://git.kernel.org/stable/c/feae34c992eb7191862fb1594c704fbbf650fef8 ↗
- https://git.kernel.org/stable/c/33660d44e789edb4f303210c813fc56d56377a90 ↗
- https://git.kernel.org/stable/c/e2e9599f3503df7cf3569d2b6c50d5488fb59435 ↗
- https://git.kernel.org/stable/c/058a0da4f6d916a79b693384111bb80a90d73763 ↗
- https://git.kernel.org/stable/c/202900ceeef67458c964c2af6e1427c8e533ea7c ↗
- https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗