The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.
[
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a1b14d27ed0965838350f1377ff97c93ee383492",
"digest": {
"function_hash": "131122229734132374690666381524421814996",
"length": 477.0
},
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_branches"
},
"id": "CVE-2016-2383-659a275b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a1b14d27ed0965838350f1377ff97c93ee383492",
"digest": {
"threshold": 0.9,
"line_hashes": [
"101782348948970843635802345438142375340",
"74313570525799071447366367651319363354",
"256836291500221223141430162603316505561",
"287929402902198773595390798678467182397"
]
},
"target": {
"file": "kernel/bpf/verifier.c"
},
"id": "CVE-2016-2383-e5d44130",
"deprecated": false,
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2383.json"
[
{
"signature_type": "Line",
"source": "https://github.com/torvalds/linux/commit/a1b14d27ed0965838350f1377ff97c93ee383492",
"digest": {
"threshold": 0.9,
"line_hashes": [
"101782348948970843635802345438142375340",
"74313570525799071447366367651319363354",
"256836291500221223141430162603316505561",
"287929402902198773595390798678467182397"
]
},
"target": {
"file": "kernel/bpf/verifier.c"
},
"id": "CVE-2016-2383-252d12d6",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://github.com/torvalds/linux/commit/a1b14d27ed0965838350f1377ff97c93ee383492",
"digest": {
"function_hash": "131122229734132374690666381524421814996",
"length": 477.0
},
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_branches"
},
"id": "CVE-2016-2383-df1a048a",
"deprecated": false,
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2383.json"