CVE-2024-53125
- Source
- https://cve.org/CVERecord?id=CVE-2024-53125
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53125.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-53125
- Downstream
- Related
- Published
- 2024-12-04T14:11:09.326Z
- Modified
- 2026-05-28T03:54:56.447739999Z
- Summary
- bpf: sync_linked_regs() must preserve subreg_def
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bpf: synclinkedregs() must preserve subreg_def
Range propagation must not affect subregdef marks, otherwise the following example is rewritten by verifier incorrectly when BPFFTESTRND_HI32 flag is set:
0: call bpfktimegetns call bpfktimegetns 1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff 2: w1 = w0 rewrites w1 = w0 3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r) 4: r1 >>= 32 r11 <<= 32 (r) 5: r0 = r1 r1 |= r11 (r) 6: exit; if w0 < 0xa goto pc+0 r1 >>= 32 r0 = r1 exit
(or zero extension of w1 at (2) is missing for architectures that require zero extension for upper register half).
The following happens w/o this patch: - r0 is marked as not a subreg at (0); - w1 is marked as subreg at (2); - w1 subregdef is overridden at (3) by copyregisterstate(); - w1 is read at (5) but markinsnzext() does not mark (2) for zero extension, because w1 subregdef is not set; - because of BPFFTESTRNDHI32 flag verifier inserts random value for hi32 bits of (2) (marked (r)); - this random value is read at (5).
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53125.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/60fd3538d2a8fd44c41d25088c0ece3e1fd30659
- https://git.kernel.org/stable/c/b57ac2d92c1f565743f6890a5b9cf317ed856b09
- https://git.kernel.org/stable/c/bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84
- https://git.kernel.org/stable/c/dadf82c1b2608727bcc306843b540cd7414055a7
- https://git.kernel.org/stable/c/e2ef0f317a52e678fe8fa84b94d6a15b466d6ff0
- https://git.kernel.org/stable/c/e9bd9c498cb0f5843996dbe5cbce7a1836a83c70
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53125.json
- https://nvd.nist.gov/vuln/detail/CVE-2024-53125
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced75748837b7e56919679e02163f45d5818c644d03Fixeddadf82c1b2608727bcc306843b540cd7414055a7Fixedb57ac2d92c1f565743f6890a5b9cf317ed856b09Fixed60fd3538d2a8fd44c41d25088c0ece3e1fd30659Fixedbfe9446ea1d95f6cb7848da19dfd58d2eec6fd84Fixede2ef0f317a52e678fe8fa84b94d6a15b466d6ff0Fixede9bd9c498cb0f5843996dbe5cbce7a1836a83c70