Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

bpf: sync_linked_regs() must preserve subreg_def (Linux Linux)

CVE-2024-53125
HIGH 7.8

At a glance

Source
NVD
EPSS
EPSS 0.23 % · percentile 14 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Search on…

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: sync_linked_regs() must preserve subreg_def Range propagation must not affect subreg_def marks, otherwise the following example is rewritten by verifier incorrectly when BPF_F_TEST_RND_HI32 flag is set: 0: call bpf_ktime_get_ns call bpf_ktime_get_ns 1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff 2: w1 = w0 rewrites w1 = w0 3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r) 4: r1 >>= 32 r11 <<= 32 (r) 5: r0 = r1 r1 |= r11 (r) 6: exit; if w0 < 0xa goto pc+0 r1 >>= 32 r0 = r1 exit (or zero extension of w1 at (2) is missing for architectures that require zero extension for upper register half). The following happens w/o this patch: - r0 is marked as not a subreg at (0); - w1 is marked as subreg at (2); - w1 subreg_def is overridden at (3) by copy_register_state(); - w1 is read at (5) but mark_insn_zext() does not mark (2) for zero extension, because w1 subreg_def is not set; - because of BPF_F_TEST_RND_HI32 flag verifier inserts random value for hi32 bits of (2) (marked (r)); - this random value is read at (5).

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 75748837b7e56919679e02163f45d5818c644d03 < dadf82c1b2608727bcc306843b540cd7414055a7 ; affected 75748837b7e56919679e02163f45d5818c644d03 < b57ac2d92c1f565743f6890a5b9cf317ed856b09 ; affected 75748837b7e56919679e02163f45d5818c644d03 < 60fd3538d2a8fd44c41d25088c0ece3e1fd30659 ; affected 75748837b7e56919679e02163f45d5818c644d03 < bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84 ; affected 75748837b7e56919679e02163f45d5818c644d03 < e2ef0f317a52e678fe8fa84b94d6a15b466d6ff0 ; affected 75748837b7e56919679e02163f45d5818c644d03 < e9bd9c498cb0f5843996dbe5cbce7a1836a83c70
Linux · Linuxaffected 5.10 ; unaffected 0 < 5.10 ; unaffected 5.10.232 ≤ 5.10.* ; unaffected 5.15.175 ≤ 5.15.* ; unaffected 6.1.121 ≤ 6.1.* ; unaffected 6.6.67 ≤ 6.6.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD