Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs.
Product status
ec0e2da95f72d4a46050a4d994e4fe471474fd80 (git) before 3bce44b344040e5eef3d64d38b157c15304c0aab
ec0e2da95f72d4a46050a4d994e4fe471474fd80 (git) before 5017c302ca4b2a45149ad64e058fa2d5623c068f
ec0e2da95f72d4a46050a4d994e4fe471474fd80 (git) before 21167bf70dbe400563e189ac632258d35eda38b5
ec0e2da95f72d4a46050a4d994e4fe471474fd80 (git) before 55c0ced59fe17dee34e9dfd5f7be63cbab207758
6.6
Any version before 6.6
6.6.112 (semver)
6.12.53 (semver)
6.17.3 (semver)
6.18-rc1 (original_commit_for_fix)
References
git.kernel.org/...c/3bce44b344040e5eef3d64d38b157c15304c0aab
git.kernel.org/...c/5017c302ca4b2a45149ad64e058fa2d5623c068f
git.kernel.org/...c/21167bf70dbe400563e189ac632258d35eda38b5
git.kernel.org/...c/55c0ced59fe17dee34e9dfd5f7be63cbab207758
