Description
In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPF_PSEUDO_FUNC reference to the main program fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below: int main(void *ctx) { void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... } The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address. Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
69c087ba6225b574afb6e505b72cb75242a3d844 to < c74750dca96f40a1adb9d334f5a3152f44b270c3affected69c087ba6225b574afb6e505b72cb75242a3d844 to < 314c8caa9cb64ad60c5b969fe9a3e2dcdccf156faffected69c087ba6225b574afb6e505b72cb75242a3d844 to < 8cb75f7ada25b1cf25f2f74dec3ba649b9064a09affected69c087ba6225b574afb6e505b72cb75242a3d844 to < 118212417ba0120d99f84154799f8880f07411f4affected69c087ba6225b574afb6e505b72cb75242a3d844 to < d6c39774ae093c9f7009cc4ae918f18fc1af7ae7affected69c087ba6225b574afb6e505b72cb75242a3d844 to < 92f0bd0e2b632c6565ac2214a4d7d2ed37e5b9f6affected69c087ba6225b574afb6e505b72cb75242a3d844 to < 374b2c5561db80fcdd7cdce44af37a49416f61c7affected
Linux Linux
Default version status: affected
5.13affected0 to < 5.13unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c74750dca96f40a1adb9d334f5a3152f44b270c3 ↗
- https://git.kernel.org/stable/c/314c8caa9cb64ad60c5b969fe9a3e2dcdccf156f ↗
- https://git.kernel.org/stable/c/8cb75f7ada25b1cf25f2f74dec3ba649b9064a09 ↗
- https://git.kernel.org/stable/c/118212417ba0120d99f84154799f8880f07411f4 ↗
- https://git.kernel.org/stable/c/d6c39774ae093c9f7009cc4ae918f18fc1af7ae7 ↗
- https://git.kernel.org/stable/c/92f0bd0e2b632c6565ac2214a4d7d2ed37e5b9f6 ↗
- https://git.kernel.org/stable/c/374b2c5561db80fcdd7cdce44af37a49416f61c7 ↗