Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to < 86b203aadc2930e0a4f9c6277b5b80ff3664c472affectedf4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to < 8109c25e0c41f5f19a1c2380bb49c991a877494eaffectedf4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to < d1959028190a7649b926f5867a58de5fe221b23caffectedf4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to < 8cb23101a3fcc7432b451ea3d0f14a90711f4acfaffectedf4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to < 29c239f8dbec5ab33a61796724d189bddee6cd4baffectedf4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to < db6382ed3361bdd8129572a3423956cba1dae829affectedf4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to < eaffa1495e4fe6330aeff9f323ea3d48b01f118aaffectedf4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to < a4c6f804b44c5c790269b25e0e61cf4e9f117c86affected
Linux Linux
Default version status: affected
4.16affected0 to < 4.16unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.152 to ≤ 6.6.*unaffected6.12.104 to ≤ 6.12.*unaffected6.18.45 to ≤ 6.18.*unaffected7.1.9 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472 ↗
- https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e ↗
- https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c ↗
- https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf ↗
- https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b ↗
- https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829 ↗
- https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a ↗
- https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86 ↗