In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as there are other protections along the way, but we should protect against it anyway. One code path was missing such protections (fixed in the previous patch in the series), causing out-of-bounds array accesses in check_stack_range_initialized(). This patch causes the verification of a program with such a non-sensical access size to fail. This check used to exist in a more indirect way, but was inadvertendly removed in a833a17aeac7.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Protección contra desbordamiento int para el tamaño de acceso a la pila. Este parche reintroduce la protección contra que el tamaño de acceso a la memoria de la pila sea negativo; el tamaño de acceso puede parecer negativo como resultado de desbordar su representación int firmada. En realidad, esto no debería suceder, ya que existen otras protecciones en el camino, pero debemos protegernos contra ello de todos modos. A una ruta de código le faltaban dichas protecciones (corregidas en el parche anterior de la serie), lo que provocaba accesos a matrices fuera de los límites en check_stack_range_initialized(). Este parche hace que falle la verificación de un programa con un tamaño de acceso tan absurdo. Esta verificación solía existir de una manera más indirecta, pero se eliminó inadvertidamente en a833a17aeac7.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-129
en
CWE-190
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c57a6c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3686cae80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbf6cb00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369990880> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c579600> | Operating System |
| linux | linux_kernel | 6.9 | <built-in method update of dict object at 0x7fd39c5788c0> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd3841407c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |