CVE-2024-53125

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-53125
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53125.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-53125
Downstream
Related
Published
2024-12-04T14:11:09.326Z
Modified
2026-03-20T12:40:45.161802Z
Summary
bpf: sync_linked_regs() must preserve subreg_def
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: synclinkedregs() must preserve subreg_def

Range propagation must not affect subregdef marks, otherwise the following example is rewritten by verifier incorrectly when BPFFTESTRND_HI32 flag is set:

0: call bpfktimegetns call bpfktimegetns 1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff 2: w1 = w0 rewrites w1 = w0 3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r) 4: r1 >>= 32 r11 <<= 32 (r) 5: r0 = r1 r1 |= r11 (r) 6: exit; if w0 < 0xa goto pc+0 r1 >>= 32 r0 = r1 exit

(or zero extension of w1 at (2) is missing for architectures that require zero extension for upper register half).

The following happens w/o this patch: - r0 is marked as not a subreg at (0); - w1 is marked as subreg at (2); - w1 subregdef is overridden at (3) by copyregisterstate(); - w1 is read at (5) but markinsnzext() does not mark (2) for zero extension, because w1 subregdef is not set; - because of BPFFTESTRNDHI32 flag verifier inserts random value for hi32 bits of (2) (marked (r)); - this random value is read at (5).

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53125.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
75748837b7e56919679e02163f45d5818c644d03
Fixed
dadf82c1b2608727bcc306843b540cd7414055a7
Fixed
b57ac2d92c1f565743f6890a5b9cf317ed856b09
Fixed
60fd3538d2a8fd44c41d25088c0ece3e1fd30659
Fixed
bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84
Fixed
e2ef0f317a52e678fe8fa84b94d6a15b466d6ff0
Fixed
e9bd9c498cb0f5843996dbe5cbce7a1836a83c70

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53125.json"