Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8. stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state. Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
06accc8779c1d558a5b5a21f2ac82b0c95827ddd to < 89a7241fc7ecc1b5e47c3f071081e314523b8d9daffected06accc8779c1d558a5b5a21f2ac82b0c95827ddd to < 79a9172f3ab4ad8392c5e5c8944b9b7710ade620affected
Linux Linux
Default version status: affected
6.4affected0 to < 6.4unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected