PT-2023-8763 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.7.0-rc3-00699-g90679706d486-dirty 494 Description: The vulnerability is related to a race condition between btf put and map free in the Linux kernel. This issue can lead to a slab-use-after-free error,...

kernel: bpf: prevent decl_tag from being referenced in func_proto

A flaw was found in the Linux kernel's BPF BTF BPF Type Format validation. The BTF parser allows a funcproto type to reference a decltag as its return type, which is invalid. When btftypeidsize encounters this unexpected type, it triggers a kernel warning. This can be exploited via the bpf syscal...

libbpf:bpf-object-fuzzer: Crash in btf_ext_setup_info

Detailed Report: https://oss-fuzz.com/testcase?key=4607488395444224 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzerasani386libbpf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x128039bd Crash State: btfextsetupinfo btfextsetupcorerelos...

PT-2023-36023 · Git +1 · Libbpf

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 4 crash has been reported. The crash involves the functions btf ensure modifiable, btf add var, and bpf object collect extern...

libbpf:bpf-object-fuzzer: Heap-buffer-overflow in btf_ensure_modifiable

Project: https://github.com/libbpf/libbpf.git Detailed Report: https://oss-fuzz.com/testcase?key=6336442949042176 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzerasanlibbpf Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

kernel: bpf: Fix UAF due to race between btf_try_get_module and load_module

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to race between btftrygetmodule and loadmodule While working on code to populate kfunc BTF ID sets for module BTF from its initcall, I noticed that by the time the initcall is invoked, the module BTF can already ...

SUSE CVE-2021-29648

An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolvedids and resolvedsizes are intentionally uninitialized in the vmlinux BPF Type Format BTF, which can cause a system crash upon an unexpected access attempt in mapcreate in...

SUSE CVE-2022-3534

A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. Upgrading to version 5.10.163, 5.15.86, 6.0.16, 6.1.2 and...

PT-2023-33635 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: A bug in BTF ID LIST has been identified when CONFIG DEBUG INFO BTF is not set. The actual impact and potential for attack have not been proven yet. Recommendations: For Linux Kernel version...

PT-2023-33880

Name of the Vulnerable Software and Affected Versions libbpf versions prior to v6.0.16 Description The issue is related to a use-after-free in btf dump name dups. The actual impact and attack plausibility have not yet been proven. It was introduced in version v5.10 and fixed in Linux Kernel versi...

PT-2023-33864

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description The issue is related to a problem in the bpf where a stack slot is clobbered when writing over a spilled PTR TO BTF ID. The actual impact and attack plausibility have not yet been proven...

PT-2025-54076

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue where a warning was triggered in the btf type id size function when processing certain BPF Berkeley Packet Filter types. Specifically, a warning occurr...

CVE-2022-3534

A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. Upgrading to version 5.10.163, 5.15.86, 6.0.16, 6.1.2 and...

DEBIAN-CVE-2022-3534

A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. Upgrading to version 5.10.163, 5.15.86, 6.0.16, 6.1.2 and...

PT-2022-7029

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A critical vulnerability has been found in the Linux Kernel, specifically in the libbpf component. The issue is related to the function btf dump name dups of the file tools/lib/bpf/btf...

PT-2022-30139

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.12 through v5.15.32 Description The issue is related to a use-after-free UAF bug due to a race between btf try get module and load module. The actual impact and attack plausibility have not yet been proven...

PT-2022-29828

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to a use-after-free UAF bug due to a race between btf try get module and load module. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-29821

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.16 through v5.16.18 Description A bug in the bpf functionality related to btf decl tag when tagging a function has been identified. The actual impact and potential for attack have not been fully determined...

PT-2022-29518

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.12 through v5.17.1 Description The issue is related to a use-after-free UAF bug due to a race between btf try get module and load module. The actual impact and attack plausibility have not yet been proven...

The vulnerability of the BPF_BTF_LOAD() function in the eBPF subsystem of Linux’s operating systems allows a malicious actor to escalate their privileges or cause service interruptions.

The vulnerability of the BPFBTFLOAD function in the eBPF subsystem of Linux kernels involves operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to gain increased privileges or cause system failures...