Description
In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent. Advance the right fragment offset by the fragment-local delta, `start - offset`, which matches the length removed from the front of the original entry.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to < f14609d8146707452e0822f3c8154674ce677251affected6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to < d81b323af2dcee47573907ccb89c0df9b45cb2e2affected6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to < aeb95146848d12206e1b2cfacd4f40e21ce81d94affected6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to < 96b72672ce849a1402730238e64d9b20bf06a96daffected6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to < 3075c21d2d76c0067f4a382765b43d6cc10470f1affected6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to < 5e19028667963fb371ebb00cecc2a473ef92056baffected6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to < 63f64a510c7917658ddf4d073ece73914ee25346affected6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to < f72eed9b84fb771019a955908132410a9ba9ea3faffected
Linux Linux
Default version status: affected
4.20affected0 to < 4.20unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f14609d8146707452e0822f3c8154674ce677251 ↗
- https://git.kernel.org/stable/c/d81b323af2dcee47573907ccb89c0df9b45cb2e2 ↗
- https://git.kernel.org/stable/c/aeb95146848d12206e1b2cfacd4f40e21ce81d94 ↗
- https://git.kernel.org/stable/c/96b72672ce849a1402730238e64d9b20bf06a96d ↗
- https://git.kernel.org/stable/c/3075c21d2d76c0067f4a382765b43d6cc10470f1 ↗
- https://git.kernel.org/stable/c/5e19028667963fb371ebb00cecc2a473ef92056b ↗
- https://git.kernel.org/stable/c/63f64a510c7917658ddf4d073ece73914ee25346 ↗
- https://git.kernel.org/stable/c/f72eed9b84fb771019a955908132410a9ba9ea3f ↗