https://github.com/torvalds/linux
Revision 95a762e2c8c942780948091f8f2a4f32fce1ac6f authored by Jann Horn on 19 December 2017, 04:11:54 UTC, committed by Daniel Borkmann on 21 December 2017, 01:15:41 UTC
Distinguish between
BPF_ALU64|BPF_MOV|BPF_K (load 32-bit immediate, sign-extended to 64-bit)
and BPF_ALU|BPF_MOV|BPF_K (load 32-bit immediate, zero-padded to 64-bit);
only perform sign extension in the first case.
Starting with v4.14, this is exploitable by unprivileged users as long as
the unprivileged_bpf_disabled sysctl isn't set.
Debian assigned CVE-2017-16995 for this issue.
v3:
- add CVE number (Ben Hutchings)
Fixes: 484611357c19 ("bpf: allow access into map value arrays")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
1 parent 4374f25
Tip revision: 95a762e2c8c942780948091f8f2a4f32fce1ac6f authored by Jann Horn on 19 December 2017, 04:11:54 UTC
bpf: fix incorrect sign extension in check_alu_op()
bpf: fix incorrect sign extension in check_alu_op()
Tip revision: 95a762e
| File | Mode | Size |
|---|---|---|
| partitions | ||
| Kconfig | -rw-r--r-- | 6.2 KB |
| Kconfig.iosched | -rw-r--r-- | 2.7 KB |
| Makefile | -rw-r--r-- | 1.5 KB |
| badblocks.c | -rw-r--r-- | 14.5 KB |
| bfq-cgroup.c | -rw-r--r-- | 33.6 KB |
| bfq-iosched.c | -rw-r--r-- | 170.4 KB |
| bfq-iosched.h | -rw-r--r-- | 31.4 KB |
| bfq-wf2q.c | -rw-r--r-- | 52.0 KB |
| bio-integrity.c | -rw-r--r-- | 13.8 KB |
| bio.c | -rw-r--r-- | 49.5 KB |
| blk-cgroup.c | -rw-r--r-- | 37.8 KB |
| blk-core.c | -rw-r--r-- | 101.1 KB |
| blk-exec.c | -rw-r--r-- | 2.9 KB |
| blk-flush.c | -rw-r--r-- | 17.0 KB |
| blk-integrity.c | -rw-r--r-- | 12.1 KB |
| blk-ioc.c | -rw-r--r-- | 11.0 KB |
| blk-lib.c | -rw-r--r-- | 10.6 KB |
| blk-map.c | -rw-r--r-- | 5.8 KB |
| blk-merge.c | -rw-r--r-- | 19.7 KB |
| blk-mq-cpumap.c | -rw-r--r-- | 1.7 KB |
| blk-mq-debugfs.c | -rw-r--r-- | 23.5 KB |
| blk-mq-debugfs.h | -rw-r--r-- | 2.1 KB |
| blk-mq-pci.c | -rw-r--r-- | 1.6 KB |
| blk-mq-rdma.c | -rw-r--r-- | 1.7 KB |
| blk-mq-sched.c | -rw-r--r-- | 15.9 KB |
| blk-mq-sched.h | -rw-r--r-- | 2.8 KB |
| blk-mq-sysfs.c | -rw-r--r-- | 8.2 KB |
| blk-mq-tag.c | -rw-r--r-- | 11.3 KB |
| blk-mq-tag.h | -rw-r--r-- | 2.3 KB |
| blk-mq-virtio.c | -rw-r--r-- | 1.7 KB |
| blk-mq.c | -rw-r--r-- | 72.3 KB |
| blk-mq.h | -rw-r--r-- | 5.2 KB |
| blk-settings.c | -rw-r--r-- | 28.7 KB |
| blk-softirq.c | -rw-r--r-- | 4.3 KB |
| blk-stat.c | -rw-r--r-- | 4.8 KB |
| blk-stat.h | -rw-r--r-- | 5.5 KB |
| blk-sysfs.c | -rw-r--r-- | 23.4 KB |
| blk-tag.c | -rw-r--r-- | 10.0 KB |
| blk-throttle.c | -rw-r--r-- | 67.8 KB |
| blk-timeout.c | -rw-r--r-- | 5.8 KB |
| blk-wbt.c | -rw-r--r-- | 17.5 KB |
| blk-wbt.h | -rw-r--r-- | 4.0 KB |
| blk-zoned.c | -rw-r--r-- | 7.6 KB |
| blk.h | -rw-r--r-- | 9.9 KB |
| bounce.c | -rw-r--r-- | 6.5 KB |
| bsg-lib.c | -rw-r--r-- | 7.5 KB |
| bsg.c | -rw-r--r-- | 22.8 KB |
| cfq-iosched.c | -rw-r--r-- | 127.1 KB |
| cmdline-parser.c | -rw-r--r-- | 4.9 KB |
| compat_ioctl.c | -rw-r--r-- | 10.9 KB |
| deadline-iosched.c | -rw-r--r-- | 11.2 KB |
| elevator.c | -rw-r--r-- | 27.2 KB |
| genhd.c | -rw-r--r-- | 47.8 KB |
| ioctl.c | -rw-r--r-- | 15.2 KB |
| ioprio.c | -rw-r--r-- | 5.0 KB |
| kyber-iosched.c | -rw-r--r-- | 21.3 KB |
| mq-deadline.c | -rw-r--r-- | 16.8 KB |
| noop-iosched.c | -rw-r--r-- | 2.6 KB |
| opal_proto.h | -rw-r--r-- | 9.3 KB |
| partition-generic.c | -rw-r--r-- | 16.8 KB |
| scsi_ioctl.c | -rw-r--r-- | 19.9 KB |
| sed-opal.c | -rw-r--r-- | 58.5 KB |
| t10-pi.c | -rw-r--r-- | 4.9 KB |
Computing file changes ...
