In the Linux kernel, the following vulnerability has been resolved: bpf: track changespktdata property for global functions When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. For example, consider the following program: attribute((noinline)) long skbpulldata(struct _skbuff *sk, _u32 len) { return bpfskbpulldata(sk, len); } SEC("tc") int testinvalidatechecks(struct _skbuff *sk) { int *p = (void *)(long)sk->data; if ((void *)(p + 1) > (void *)(long)sk->dataend) return TCXDROP; skbpulldata(sk, 0); *p = 42; return TCXPASS; } After a call to bpfskbpulldata() the pointer 'p' can't be used safely. See function filter.c:bpfhelperchangespktdata() for a list of such helpers. At the moment verifier invalidates packet pointers when processing helper function calls, and does not traverse global sub-programs when processing calls to global sub-programs. This means that calls to helpers done from global sub-programs do not invalidate pointers in the caller state. E.g. the program above is unsafe, but is not rejected by verifier. This commit fixes the omission by computing field bpfsubproginfo->changespktdata for each sub-program before main verification pass. changespktdata should be set if: - subprogram calls helper for which bpfhelperchangespktdata returns true; - subprogram calls a global function, for which bpfsubproginfo->changespktdata should be set. The verifier.c:checkcfg() pass is modified to compute this information. The commit relies on depth first instruction traversal done by checkcfg() and absence of recursive function calls: - checkcfg() would eventually visit every call to subprogram S in a state when S is fully explored; - when S is fully explored: - every direct helper call within S is explored (and thus changespktdata is set if needed); - every call to subprogram S1 called by S was visited with S1 fully explored (and thus S inherits changespktdata from S1). The downside of such approach is that dead code elimination is not taken into account: if a helper call inside global function is dead because of current configuration, verifier would conservatively assume that the call occurs for the purpose of the changespkt_data computation.
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-headers-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-image-unsigned-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-image-unsigned-6.14.0-1005-oem-dbgsym", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-modules-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-modules-ipu6-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-modules-ipu7-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-modules-iwlwifi-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-modules-usbio-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-modules-vision-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-oem-6.14-headers-6.14.0-1005", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-oem-6.14-tools-6.14.0-1005", "binary_version": "6.14.0-1005.5" }, { "binary_name": "linux-tools-6.14.0-1005-oem", "binary_version": "6.14.0-1005.5" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "linux-bpf-dev", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-buildinfo-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-buildinfo-6.14.0-7-generic-64k", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-cloud-tools-6.14.0-7", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-cloud-tools-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-cloud-tools-common", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-doc", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-headers-6.14.0-7", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-headers-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-headers-6.14.0-7-generic-64k", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-image-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-image-6.14.0-7-generic-dbgsym", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-image-unsigned-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-image-unsigned-6.14.0-7-generic-64k", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-image-unsigned-6.14.0-7-generic-64k-dbgsym", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-image-unsigned-6.14.0-7-generic-dbgsym", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-lib-rust-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-libc-dev", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-modules-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-modules-6.14.0-7-generic-64k", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-modules-extra-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-modules-usbio-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-modules-vision-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-source-6.14.0", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-tools-6.14.0-7", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-tools-6.14.0-7-generic", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-tools-6.14.0-7-generic-64k", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-tools-common", "binary_version": "6.14.0-7.7" }, { "binary_name": "linux-tools-host", "binary_version": "6.14.0-7.7" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "linux-aws-cloud-tools-6.14.0-1003", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-aws-headers-6.14.0-1003", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-aws-tools-6.14.0-1003", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-buildinfo-6.14.0-1003-aws", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-cloud-tools-6.14.0-1003-aws", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-headers-6.14.0-1003-aws", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-image-unsigned-6.14.0-1003-aws", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-image-unsigned-6.14.0-1003-aws-dbgsym", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-modules-6.14.0-1003-aws", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-modules-extra-6.14.0-1003-aws", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-tools-6.14.0-1003-aws", "binary_version": "6.14.0-1003.3" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "linux-azure-cloud-tools-6.14.0-1002", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-azure-headers-6.14.0-1002", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-azure-tools-6.14.0-1002", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-buildinfo-6.14.0-1002-azure", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-cloud-tools-6.14.0-1002-azure", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-headers-6.14.0-1002-azure", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-azure", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-azure-dbgsym", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-6.14.0-1002-azure", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-extra-6.14.0-1002-azure", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-tools-6.14.0-1002-azure", "binary_version": "6.14.0-1002.2" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1002-gcp", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-buildinfo-6.14.0-1002-gcp-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-gcp-headers-6.14.0-1002", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-gcp-tools-6.14.0-1002", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-headers-6.14.0-1002-gcp", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-headers-6.14.0-1002-gcp-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-gcp", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-gcp-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-gcp-64k-dbgsym", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-gcp-dbgsym", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-6.14.0-1002-gcp", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-6.14.0-1002-gcp-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-extra-6.14.0-1002-gcp", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-extra-6.14.0-1002-gcp-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-tools-6.14.0-1002-gcp", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-tools-6.14.0-1002-gcp-64k", "binary_version": "6.14.0-1002.2" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1002-oracle", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-buildinfo-6.14.0-1002-oracle-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-headers-6.14.0-1002-oracle", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-headers-6.14.0-1002-oracle-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-oracle", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-oracle-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-oracle-64k-dbgsym", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-image-unsigned-6.14.0-1002-oracle-dbgsym", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-6.14.0-1002-oracle", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-6.14.0-1002-oracle-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-extra-6.14.0-1002-oracle", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-modules-extra-6.14.0-1002-oracle-64k", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-oracle-headers-6.14.0-1002", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-oracle-tools-6.14.0-1002", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-tools-6.14.0-1002-oracle", "binary_version": "6.14.0-1002.2" }, { "binary_name": "linux-tools-6.14.0-1002-oracle-64k", "binary_version": "6.14.0-1002.2" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1003-raspi", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-headers-6.14.0-1003-raspi", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-image-6.14.0-1003-raspi", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-image-6.14.0-1003-raspi-dbgsym", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-modules-6.14.0-1003-raspi", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-raspi-headers-6.14.0-1003", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-raspi-tools-6.14.0-1003", "binary_version": "6.14.0-1003.3" }, { "binary_name": "linux-tools-6.14.0-1003-raspi", "binary_version": "6.14.0-1003.3" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1001-realtime", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-cloud-tools-6.14.0-1001-realtime", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-headers-6.14.0-1001-realtime", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1001-realtime", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1001-realtime-dbgsym", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-modules-6.14.0-1001-realtime", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-modules-extra-6.14.0-1001-realtime", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-modules-iwlwifi-6.14.0-1001-realtime", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-realtime-cloud-tools-6.14.0-1001", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-realtime-headers-6.14.0-1001", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-realtime-tools-6.14.0-1001", "binary_version": "6.14.0-1001.1" }, { "binary_name": "linux-tools-6.14.0-1001-realtime", "binary_version": "6.14.0-1001.1" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-7-generic", "binary_version": "6.14.0-7.7.1" }, { "binary_name": "linux-headers-6.14.0-7-generic", "binary_version": "6.14.0-7.7.1" }, { "binary_name": "linux-image-6.14.0-7-generic", "binary_version": "6.14.0-7.7.1" }, { "binary_name": "linux-image-6.14.0-7-generic-dbgsym", "binary_version": "6.14.0-7.7.1" }, { "binary_name": "linux-modules-6.14.0-7-generic", "binary_version": "6.14.0-7.7.1" }, { "binary_name": "linux-riscv-headers-6.14.0-7", "binary_version": "6.14.0-7.7.1" }, { "binary_name": "linux-riscv-tools-6.14.0-7", "binary_version": "6.14.0-7.7.1" }, { "binary_name": "linux-tools-6.14.0-7-generic", "binary_version": "6.14.0-7.7.1" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }