SUSE CVE-2021-47303

In the Linux kernel, the following vulnerability has been resolved: bpf: Track subprog poke descriptors correctly and fix use-after-free Subprograms are calling mappoketrack, but on program release there is no hook to call mappokeuntrack. However, on program release, the aux memory and poke...

SUSE CVE-2021-47486

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix potential NULL dereference The bpfjitbinaryfree function requires a non-NULL argument. When the RISC-V BPF JIT fails to converge in NRJITITERATIONS steps, jitdata-header will be NULL, which triggers a NULL...

kernel: bpf, cpumap: Make sure kthread is running before map update returns

A race condition was found in the Linux kernel's BPF cpumap implementation in the kthread lifecycle management. A local user can trigger this issue by running XDP redirect operations when the per-CPU kthread is stopped prematurely before processing queued frames, causing the cleanup code to find ...

kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges

A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system...

DEBIAN-CVE-2021-47486

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix potential NULL dereference The bpfjitbinaryfree function requires a non-NULL argument. When the RISC-V BPF JIT fails to converge in NRJITITERATIONS steps, jitdata-header will be NULL, which triggers a NULL...

UBUNTU-CVE-2023-52828

In the Linux kernel, the following vulnerability has been resolved: bpf: Detect IP == ksym.end as part of BPF program Now that bpfthrow kfunc is the first such call instruction that has noreturn semantics within the verifier, this also kicks in dead code elimination in unprecedented ways. For one...

DEBIAN-CVE-2021-47298

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix potential memory leak on unlikely error case If skblinearize is needed and fails we could leak a msg on the error handling. To fix ensure we kfree the msg block before returning error. Found during code review...

UBUNTU-CVE-2021-47317

In the Linux kernel, the following vulnerability has been resolved: powerpc/bpf: Fix detecting BPF atomic instructions Commit 91c960b0056672 "bpf: Rename BPFXADD and prepare to encode other atomics in .imm" converted BPFXADD to BPFATOMIC and added a way to distinguish instructions based on the...

SUSE CVE-2024-35894

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent BPF accessing lowat from a subflow socket. Alexei reported the following splat: WARNING: CPU: 32 PID: 3276 at net/mptcp/subflow.c:1430 subflowdataready+0x147/0x1c0 Modules linked in: dummy bpftestmodO last unloaded...

SUSE CVE-2024-35905

In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a check added to the powerpc64 JIT not looking at the correct BPF instruction...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from a memory leak in the bpf, s390 module...

PT-2024-11316 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the powerpc/bpf component of the Linux kernel, where a check added to the powerpc64 JIT did not look at the correct BPF instruction. This resulted in programs...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a security vulnerability that stems from a flaw in the bpf module...

DEBIAN-CVE-2024-35905

In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int...

DEBIAN-CVE-2024-35894

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent BPF accessing lowat from a subflow socket. Alexei reported the following splat: WARNING: CPU: 32 PID: 3276 at net/mptcp/subflow.c:1430 subflowdataready+0x147/0x1c0 Modules linked in: dummy bpftestmodO last unloaded...

UBUNTU-CVE-2024-35895

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any...

UBUNTU-CVE-2024-35903

In the Linux kernel, the following vulnerability has been resolved: x86/bpf: Fix IP after emitting call depth accounting Adjust the IP passed to emitpatch so it calculates the correct offset for the CALL instruction if x86calldepthemitaccounting emits code. Otherwise we will skip some instruction...

UBUNTU-CVE-2024-35860

In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpflink dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and...

kernel: bpf: Make bpf_refcount_acquire fallible for non-owning refs

A memory-safety flaw was found in the Linux kernel extended Berkeley Packet Filter eBPF subsystem in the way reference counts are acquired for objects after a failed tree insertion. When a program attempts to acquire a reference to a node that may already have been released, the reference count...