Description
In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check. Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference. Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.
Product status
b453361384c2db1c703dacb806d5fd36aec4ceca (git) before 10bc4a4dcded509c5d5c67d497900c3922c604cd
20b2aff4bc15bda809f994761d5719827d66c0b4 (git) before 21a10c06ffae24cb01fd174a7ab7736001d2ea56
20b2aff4bc15bda809f994761d5719827d66c0b4 (git) before 8755066f7bd0f4ac46a29d1708c7b20894539252
20b2aff4bc15bda809f994761d5719827d66c0b4 (git) before 70abd9d118da2f56beb4ec22e3a29becae373535
20b2aff4bc15bda809f994761d5719827d66c0b4 (git) before 63276547debc4d8a73eefb2c5273b2a905c961b0
20b2aff4bc15bda809f994761d5719827d66c0b4 (git) before 4f6c99dc0420f1a3d671c1b8ab8a7ac84d9cba09
20b2aff4bc15bda809f994761d5719827d66c0b4 (git) before b0db1accbc7395657c2b79db59fa9fae0d6656f3
e982070f8970bb62e69ed7c9cafff886ed200349 (git)
5.17
Any version before 5.17
5.15.203 (semver)
6.1.168 (semver)
6.6.134 (semver)
6.12.81 (semver)
6.18.22 (semver)
6.19.12 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/10bc4a4dcded509c5d5c67d497900c3922c604cd
git.kernel.org/...c/21a10c06ffae24cb01fd174a7ab7736001d2ea56
git.kernel.org/...c/8755066f7bd0f4ac46a29d1708c7b20894539252
git.kernel.org/...c/70abd9d118da2f56beb4ec22e3a29becae373535
git.kernel.org/...c/63276547debc4d8a73eefb2c5273b2a905c961b0
git.kernel.org/...c/4f6c99dc0420f1a3d671c1b8ab8a7ac84d9cba09
git.kernel.org/...c/b0db1accbc7395657c2b79db59fa9fae0d6656f3