Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpf_netns_link_update_prog In bpf_netns_link_update_prog, the checks for old_prog and prog type are currently performed locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a UAF issue. If two threads concurrently execute BPF_LINK_UPDATE on the same netns link, the following execution path can trigger a UAF: CPU0 CPU1 bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) return -EPERM; bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) ... old_prog = xchg(&link->prog, new_prog); bpf_prog_put(old_prog); if (new_prog->type != link->prog->type) <-- trigger UAF Fix this by moving the old_prog and prog->type checks inside the netns_bpf_mutex critical section. Meanwhile, use guard() to simplify lock management and avoid all the goto jumping.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7f045a49fee04b5662cbdeaf0838f9322ae8c63a to < d462b5481d77ce7df8a5ff89a699386f00c9214daffected7f045a49fee04b5662cbdeaf0838f9322ae8c63a to < bdddf3e1493ee973619c154a57071ce67f78598baffected7f045a49fee04b5662cbdeaf0838f9322ae8c63a to < 79a66fd997d4eecf17302d613194879eb32e0986affected7f045a49fee04b5662cbdeaf0838f9322ae8c63a to < f4ce6803df4095777191d800bebc50219b615ca0affected7f045a49fee04b5662cbdeaf0838f9322ae8c63a to < 277168cb9d153ce8e9c3f9275670e32ae61b41d6affected7f045a49fee04b5662cbdeaf0838f9322ae8c63a to < bda86e9f31b9a296b6e64a51c91dc776fc9f613eaffected7f045a49fee04b5662cbdeaf0838f9322ae8c63a to < 923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7affected7f045a49fee04b5662cbdeaf0838f9322ae8c63a to < 5c5997836381010fc5907b36bc17d3b19407e933affected
Linux Linux
Default version status: affected
5.8affected0 to < 5.8unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d462b5481d77ce7df8a5ff89a699386f00c9214d ↗
- https://git.kernel.org/stable/c/bdddf3e1493ee973619c154a57071ce67f78598b ↗
- https://git.kernel.org/stable/c/79a66fd997d4eecf17302d613194879eb32e0986 ↗
- https://git.kernel.org/stable/c/f4ce6803df4095777191d800bebc50219b615ca0 ↗
- https://git.kernel.org/stable/c/277168cb9d153ce8e9c3f9275670e32ae61b41d6 ↗
- https://git.kernel.org/stable/c/bda86e9f31b9a296b6e64a51c91dc776fc9f613e ↗
- https://git.kernel.org/stable/c/923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7 ↗
- https://git.kernel.org/stable/c/5c5997836381010fc5907b36bc17d3b19407e933 ↗