kernel: local privileges escalation in kernel/bpf/verifier.c

A flaw was found in the Linux kernel's adjustptrminmaxvals in the kernel/bpf/verifier.c function. In this flaw, a missing sanity check for ORNULL pointer types that perform pointer arithmetic may cause a kernel information leak issue...

The vulnerability of the htab_map_alloc() function in the kernel/bpf/hashtab.c module of the BPF subsystem in Linux kernel-based operating systems on 32-bit architectures allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the htabmapalloc function in the kernel/bpf/hashtab.c module of the Linux operating system’s BPF subsystem in 32-bit architectures is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the dev_map_init_map() function in the kernel/bpf/devmap.c module of the BPF subsystem of the Linux operating system allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the devmapinitmap function in the kernel/bpf/devmap.c module of the Linux kernel’s BPF subsystem is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2024-41802

Уязвимость функции bpf prog attach check attach type модуля kernel/bpf/syscall.c поддержки интерпретатора BPF ядра операционной системы Linux связана с некорректной инициализацией ресурса. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

The vulnerability of the bpf_map_put() function in the kernel/bpf/syscall.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the bpfmapput function in the kernel/bpf/syscall.c module of the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

kernel: bpf: Skip invalid kfunc call in backtrack_insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrackinsn The verifier skips invalid kfunc call in checkkfunccall, which would be captured in fixupkfunccall if such insn is not eliminated by dead code elimination. However, this can lead to t...

PT-2023-36710

Уязвимость функции cpu map ring cleanup модуля kernel/bpf/cpumap.c поддержки интерпретатора BPF ядра операционной системы Linux связана с некорректной проверкой кода возврата функции. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

SUSE CVE-2018-25020

The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c...

CVE-2022-3646 Linux Kernel BPF segment.c nilfs_attach_log_writer memory leak

A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfsattachlogwriter of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply ...

UBUNTU-CVE-2022-3606

A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function findprogbysecinsn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The...

CVE-2022-2785

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

UBUNTU-CVE-2022-2785

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

Design/Logic Flaw

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

CVE-2022-2785

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

PT-2022-4895 · Linux · Linux Kernel Bpf

Name of the Vulnerable Software and Affected Versions: Linux Kernel BPF affected versions not specified Description: The issue is related to an arbitrary memory read within the Linux Kernel BPF. Constants provided to fill pointers in structs passed to bpf sys bpf are not verified and can point...

PUB-A-215814262

In kernel/bpf/verifier.c , there is a possible way to manipulate pointer arithmetic due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2022-38075

Уязвимость функции bpf jit blind constants модуля kernel/bpf/core.c поддержки интерпретатора BPF ядра операционной системы Linux связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

UBUNTU-CVE-2022-0500

A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system...

CVE-2021-45402

The checkaluop function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."...

CVE-2021-45402

CVE-2021-45402 affects the Linux kernel where check_alu_op() in kernel/bpf/verifier.c does not update bounds properly when handling mov32, enabling local attackers to leak potentially sensitive addresses (pointer leak). The description is consistently cited across multiple connected advisories (e...