Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never returns NULL -- when the current element is the last entry it wraps to the list head via container_of(). The subsequent NULL check is therefore dead code and get_next_key() never returns -ENOENT for the last element, instead reading storage->key from a bogus pointer that aliases internal map fields and copying the result to userspace. Replace it with list_entry_is_head() so the function correctly returns -ENOENT when there are no more entries.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
de9cbbaadba5adf88a19e46df61f7054000838f6 to < 0f3d9dd5e1fd52b39e25328307c6a694e994ffe3affectedde9cbbaadba5adf88a19e46df61f7054000838f6 to < 26d3339e465e54107bd85884341d1609c5300d6aaffectedde9cbbaadba5adf88a19e46df61f7054000838f6 to < 2c88b2d96e1d4d0c7c4589a4593d4cdee6d332d6affectedde9cbbaadba5adf88a19e46df61f7054000838f6 to < b4b5a20bed82130da2f2818f04d52378952fbd0baffectedde9cbbaadba5adf88a19e46df61f7054000838f6 to < 85a2f30e40f7468db732f55659bc6318874f49afaffectedde9cbbaadba5adf88a19e46df61f7054000838f6 to < 32ce55d424395904986f5066f8755f6cb9993377affectedde9cbbaadba5adf88a19e46df61f7054000838f6 to < fc39753b7f92e09177777e9c648afe5aa3abb81faffectedde9cbbaadba5adf88a19e46df61f7054000838f6 to < 5828b9e5b272ecff7cf5d345128d3de7324117f7affected
Linux Linux
Default version status: affected
4.19affected0 to < 4.19unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0f3d9dd5e1fd52b39e25328307c6a694e994ffe3 ↗
- https://git.kernel.org/stable/c/26d3339e465e54107bd85884341d1609c5300d6a ↗
- https://git.kernel.org/stable/c/2c88b2d96e1d4d0c7c4589a4593d4cdee6d332d6 ↗
- https://git.kernel.org/stable/c/b4b5a20bed82130da2f2818f04d52378952fbd0b ↗
- https://git.kernel.org/stable/c/85a2f30e40f7468db732f55659bc6318874f49af ↗
- https://git.kernel.org/stable/c/32ce55d424395904986f5066f8755f6cb9993377 ↗
- https://git.kernel.org/stable/c/fc39753b7f92e09177777e9c648afe5aa3abb81f ↗
- https://git.kernel.org/stable/c/5828b9e5b272ecff7cf5d345128d3de7324117f7 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗