Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was negative. Note that $at is mapped to BPF_REG_AX, which is used for constant blinding. Fix the instruction to use the immediate form. Found with test_bpf on MIPS32r1 emulated by QEMU.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
eb63cfcd2ee8ec3805f6881f43341f589c3d2278 to < 1547e9f3a7d71971216e6dba30270cae13fe4e02affectedeb63cfcd2ee8ec3805f6881f43341f589c3d2278 to < beeae92e70e705e90a0d6d9b3b8498ee3b92f495affectedeb63cfcd2ee8ec3805f6881f43341f589c3d2278 to < 6f939529ed6c580e9b6c5daa20be67fa0b3d4cf0affectedeb63cfcd2ee8ec3805f6881f43341f589c3d2278 to < 876ef04c75c2751acfd355606fca3eced71dec65affectedeb63cfcd2ee8ec3805f6881f43341f589c3d2278 to < 1bd91670966a7142ac94f2cebe2b5ae6bf5cb0c8affectedeb63cfcd2ee8ec3805f6881f43341f589c3d2278 to < db762fd96be225bd06161c9631160c755d891693affected
Linux Linux
Default version status: affected
5.16affected0 to < 5.16unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1547e9f3a7d71971216e6dba30270cae13fe4e02 ↗
- https://git.kernel.org/stable/c/beeae92e70e705e90a0d6d9b3b8498ee3b92f495 ↗
- https://git.kernel.org/stable/c/6f939529ed6c580e9b6c5daa20be67fa0b3d4cf0 ↗
- https://git.kernel.org/stable/c/876ef04c75c2751acfd355606fca3eced71dec65 ↗
- https://git.kernel.org/stable/c/1bd91670966a7142ac94f2cebe2b5ae6bf5cb0c8 ↗
- https://git.kernel.org/stable/c/db762fd96be225bd06161c9631160c755d891693 ↗