Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write. Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect. To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
aeea1b86f9363f3feabb496534d886f082a89f21 to < 88df604f0d16a692867582350ce3f2fcd22243f1affectedaeea1b86f9363f3feabb496534d886f082a89f21 to < 5000e40acc8d0c36ab709662e32120986ac22e7eaffectedaeea1b86f9363f3feabb496534d886f082a89f21 to < 8a95fb9df1105b1618872c2846a6c01e3ba20b45affectedaeea1b86f9363f3feabb496534d886f082a89f21 to < d2c31d8e03d05edc16656e5ffe187f0d1da763d7affectedaeea1b86f9363f3feabb496534d886f082a89f21 to < 75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2affectedaeea1b86f9363f3feabb496534d886f082a89f21 to < ca831567908fd3f73cf97d8a6c09a5054697a182affectedaeea1b86f9363f3feabb496534d886f082a89f21 to < b7bf516c3ecd9a2aae2dc2635178ab87b734fef1affected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.77 to ≤ 6.12.*unaffected6.18.17 to ≤ 6.18.*unaffected6.19.7 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1 ↗
- https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e ↗
- https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45 ↗
- https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7 ↗
- https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2 ↗
- https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182 ↗
- https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗