In the Linux kernel, the following vulnerability has been resolved:
bpf: synclinkedregs() must preserve subreg_def
Range propagation must not affect subregdef marks, otherwise the following example is rewritten by verifier incorrectly when BPFFTESTRND_HI32 flag is set:
0: call bpfktimegetns call bpfktimegetns 1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff 2: w1 = w0 rewrites w1 = w0 3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r) 4: r1 >>= 32 r11 <<= 32 (r) 5: r0 = r1 r1 |= r11 (r) 6: exit; if w0 < 0xa goto pc+0 r1 >>= 32 r0 = r1 exit
(or zero extension of w1 at (2) is missing for architectures that require zero extension for upper register half).
The following happens w/o this patch: - r0 is marked as not a subreg at (0); - w1 is marked as subreg at (2); - w1 subregdef is overridden at (3) by copyregisterstate(); - w1 is read at (5) but markinsnzext() does not mark (2) for zero extension, because w1 subregdef is not set; - because of BPFFTESTRNDHI32 flag verifier inserts random value for hi32 bits of (2) (marked (r)); - this random value is read at (5).
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"55103399585501590162564473424981736455",
"180932731986145315591549474601718491845",
"300836493931879543821832298322721295933",
"145960061386356223606728851359767815149",
"247119205294060601949255367970923172738",
"282666915683803268246528608339572084310",
"313334291161355600615702126255545059478",
"339915672550847177065055001651464603487",
"53445114448249146072562942399106365445",
"33773497737188950317454605725368972058"
]
},
"id": "CVE-2024-53125-09499ece",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2ef0f317a52e678fe8fa84b94d6a15b466d6ff0",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"14173337674689616239850102401098437920",
"212643832024480817862042564523195657121",
"268479784315012617394826602410569377619",
"170448587172186302197958778942319582929",
"177447599162056533874072449586356073201"
]
},
"id": "CVE-2024-53125-282b53b0",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84",
"deprecated": false
},
{
"digest": {
"function_hash": "112925246374580783392549219278969454971",
"length": 238.0
},
"id": "CVE-2024-53125-4c26e57b",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "find_equal_scalars"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b57ac2d92c1f565743f6890a5b9cf317ed856b09",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"14173337674689616239850102401098437920",
"212643832024480817862042564523195657121",
"268479784315012617394826602410569377619",
"170448587172186302197958778942319582929",
"177447599162056533874072449586356073201"
]
},
"id": "CVE-2024-53125-5df58f80",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dadf82c1b2608727bcc306843b540cd7414055a7",
"deprecated": false
},
{
"digest": {
"function_hash": "112925246374580783392549219278969454971",
"length": 238.0
},
"id": "CVE-2024-53125-6d3d6498",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "find_equal_scalars"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dadf82c1b2608727bcc306843b540cd7414055a7",
"deprecated": false
},
{
"digest": {
"function_hash": "42338107631282303660394982736844136979",
"length": 742.0
},
"id": "CVE-2024-53125-7c0596b7",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "find_equal_scalars"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2ef0f317a52e678fe8fa84b94d6a15b466d6ff0",
"deprecated": false
},
{
"digest": {
"function_hash": "112925246374580783392549219278969454971",
"length": 238.0
},
"id": "CVE-2024-53125-8d522621",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "find_equal_scalars"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"55103399585501590162564473424981736455",
"180932731986145315591549474601718491845",
"300836493931879543821832298322721295933",
"145960061386356223606728851359767815149",
"247119205294060601949255367970923172738",
"282666915683803268246528608339572084310",
"313334291161355600615702126255545059478",
"339915672550847177065055001651464603487",
"53445114448249146072562942399106365445",
"33773497737188950317454605725368972058"
]
},
"id": "CVE-2024-53125-a66c1186",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9bd9c498cb0f5843996dbe5cbce7a1836a83c70",
"deprecated": false
},
{
"digest": {
"function_hash": "112925246374580783392549219278969454971",
"length": 238.0
},
"id": "CVE-2024-53125-ad0768e5",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "find_equal_scalars"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60fd3538d2a8fd44c41d25088c0ece3e1fd30659",
"deprecated": false
},
{
"digest": {
"function_hash": "240170734188876295192452821188444247210",
"length": 955.0
},
"id": "CVE-2024-53125-ad5ba841",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "sync_linked_regs"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9bd9c498cb0f5843996dbe5cbce7a1836a83c70",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"14173337674689616239850102401098437920",
"212643832024480817862042564523195657121",
"268479784315012617394826602410569377619",
"170448587172186302197958778942319582929",
"177447599162056533874072449586356073201"
]
},
"id": "CVE-2024-53125-caeee60c",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60fd3538d2a8fd44c41d25088c0ece3e1fd30659",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"14173337674689616239850102401098437920",
"212643832024480817862042564523195657121",
"268479784315012617394826602410569377619",
"170448587172186302197958778942319582929",
"177447599162056533874072449586356073201"
]
},
"id": "CVE-2024-53125-f9e67e72",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b57ac2d92c1f565743f6890a5b9cf317ed856b09",
"deprecated": false
}
]