In the Linux kernel, the following vulnerability has been resolved:
bpf: reject BPF_PSEUDO_FUNC reference to the main program
fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real
function addresses. This function is invoked from bpf_jit_subprogs()
only when env->subprog_cnt > 1. Meaning that for any program like
below:
int main(void *ctx) {
void *ptr = main;
...
bpf_timer_set_callback(..., ptr);
...
}
The 'ptr' won't be ever converted to contain an address.
In combination with e.g. bpf_timer_set_callback() this would lead to a
function call at a bogus address.
Instead of complicating the implementation, just assume that no useful
program needs main to be a sync or async callback and reject
BPF_PSEUDO_FUNC loads for the main subprogram.
from 69c087ba6225b574afb6e505b72cb75242a3d844 before c74750dca96f40a1adb9d334f5a3152f44b270c3; from 69c087ba6225b574afb6e505b72cb75242a3d844 before 314c8caa9cb64ad60c5b969fe9a3e2dcdccf156f; 69c087ba6225b574afb6e505b72cb75242a3d844 builds before 8cb75f7ada25b1cf25f2f74dec3ba649b9064a09; from 69c087ba6225b574afb6e505b72cb75242a3d844 before 118212417ba0120d99f84154799f8880f07411f4; from 69c087ba6225b574afb6e505b72cb75242a3d844 before d6c39774ae093c9f7009cc4ae918f18fc1af7ae7; from 69c087ba6225b574afb6e505b72cb75242a3d844 before 92f0bd0e2b632c6565ac2214a4d7d2ed37e5b9f6; from 69c087ba6225b574afb6e505b72cb75242a3d844 before 374b2c5561db80fcdd7cdce44af37a49416f61c7
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
