Description
In the Linux kernel, the following vulnerability has been resolved: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() CO-RE accessor strings are colon-separated indices that describe a path from a root BTF type to a target field, e.g. "0:1:2" walks through nested struct members. bpf_core_parse_spec() parses each component with sscanf("%d"), so negative values like -1 are silently accepted. The subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the upper bound and always pass for negative values because C integer promotion converts the __u16 btf_vlen result to int, making the comparison (int)(-1) >= (int)(N) false for any positive N. When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff, producing an out-of-bounds read far past the members array. A crafted BPF program with a negative CO-RE accessor on any struct that exists in vmlinux BTF (e.g. task_struct) crashes the kernel deterministically during BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y (default on major distributions). The bug is reachable with CAP_BPF: BUG: unable to handle page fault for address: ffffed11818b6626 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full) RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354) RAX: 00000000ffffffff Call Trace: <TASK> bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321) bpf_core_apply (kernel/bpf/btf.c:9507) check_core_relo (kernel/bpf/verifier.c:19475) bpf_check (kernel/bpf/verifier.c:26031) bpf_prog_load (kernel/bpf/syscall.c:3089) __sys_bpf (kernel/bpf/syscall.c:6228) </TASK> CO-RE accessor indices are inherently non-negative (struct member index, array element index, or enumerator index), so reject them immediately after parsing.
Product status
ddc7c3042614e273044f698d2beab25cc3842d45 (git) before a9e777f856cd2f1efc106afc7bf21aef868509d5
ddc7c3042614e273044f698d2beab25cc3842d45 (git) before 669349b4612c26b3d7aacfa99d7174681bd19223
ddc7c3042614e273044f698d2beab25cc3842d45 (git) before 3ff85ae79e1a74baeb916b78a63d821f6d19a994
ddc7c3042614e273044f698d2beab25cc3842d45 (git) before 36a9012f76ba8d9189ae56a1f8bb7c87c07a1f3a
ddc7c3042614e273044f698d2beab25cc3842d45 (git) before 76f2ebaf79a9ae6d0737b87f045fe769e425d78f
ddc7c3042614e273044f698d2beab25cc3842d45 (git) before 99dbab7b5a12d8f58d5b0aa2f7a1fe656a70f4b2
ddc7c3042614e273044f698d2beab25cc3842d45 (git) before 1c22483a2c4bbf747787f328392ca3e68619c4dc
5.4
Any version before 5.4
5.15.209 (semver)
6.1.175 (semver)
6.6.141 (semver)
6.12.91 (semver)
6.18.33 (semver)
7.0.10 (semver)
7.1-rc1 (original_commit_for_fix)
References
git.kernel.org/...c/a9e777f856cd2f1efc106afc7bf21aef868509d5
git.kernel.org/...c/669349b4612c26b3d7aacfa99d7174681bd19223
git.kernel.org/...c/3ff85ae79e1a74baeb916b78a63d821f6d19a994
git.kernel.org/...c/36a9012f76ba8d9189ae56a1f8bb7c87c07a1f3a
git.kernel.org/...c/76f2ebaf79a9ae6d0737b87f045fe769e425d78f
git.kernel.org/...c/99dbab7b5a12d8f58d5b0aa2f7a1fe656a70f4b2
git.kernel.org/...c/1c22483a2c4bbf747787f328392ca3e68619c4dc