Description
In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b5dc0163d8fd78e64a7e21f309cf932fda34353e to < febbb66e682d8328f7c5bcbdd5e4291abab2e858affectedb5dc0163d8fd78e64a7e21f309cf932fda34353e to < 627089c278df58749f25686c6a3caf7e181b5951affectedb5dc0163d8fd78e64a7e21f309cf932fda34353e to < b1fe6379e401b8ce0f561cb4d84af2b70b4343c3affectedb5dc0163d8fd78e64a7e21f309cf932fda34353e to < 69a9ad004ccf5d45e534c7d503f47f643abe64b7affectedb5dc0163d8fd78e64a7e21f309cf932fda34353e to < 1a3a10b030c96ea88868ccc060a16827c01eaa5aaffected
Linux Linux
Default version status: affected
5.3affected0 to < 5.3unaffected6.6.160 to ≤ 6.6.*unaffected6.12.114 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/febbb66e682d8328f7c5bcbdd5e4291abab2e858 ↗
- https://git.kernel.org/stable/c/627089c278df58749f25686c6a3caf7e181b5951 ↗
- https://git.kernel.org/stable/c/b1fe6379e401b8ce0f561cb4d84af2b70b4343c3 ↗
- https://git.kernel.org/stable/c/69a9ad004ccf5d45e534c7d503f47f643abe64b7 ↗
- https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a ↗