Description
In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots. Compute the register count from arg_size for all arguments to fix it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to < 2189232984b45ac8281c80484ab9f67b380a2ca1affecteda9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to < 7f96bf0d24b2acc0732906b60a10f06783f2470daffecteda9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to < 4aed2346fa9b88d458eeb8c01123f3c07585a675affecteda9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to < 40f3bfbbb222b92278f3797614b70f68d46824acaffecteda9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to < a6d7d7a253c550e74b0651897fe313c2f9b2301faffecteda9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to < 814cba835ef648e0c5eb79505c96c0493b29eea6affected
Linux Linux
Default version status: affected
6.1affected0 to < 6.1unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2189232984b45ac8281c80484ab9f67b380a2ca1 ↗
- https://git.kernel.org/stable/c/7f96bf0d24b2acc0732906b60a10f06783f2470d ↗
- https://git.kernel.org/stable/c/4aed2346fa9b88d458eeb8c01123f3c07585a675 ↗
- https://git.kernel.org/stable/c/40f3bfbbb222b92278f3797614b70f68d46824ac ↗
- https://git.kernel.org/stable/c/a6d7d7a253c550e74b0651897fe313c2f9b2301f ↗
- https://git.kernel.org/stable/c/814cba835ef648e0c5eb79505c96c0493b29eea6 ↗