Description
In the Linux kernel, the following vulnerability has been resolved: bpf: devmap: provide rxq after redirect rxq contains a pointer to the device from where the redirect happened. Currently, the BPF program that was executed after a redirect via BPF_MAP_TYPE_DEVMAP* does not have it set. This is particularly bad since accessing ingress_ifindex, e.g. SEC("xdp") int prog(struct xdp_md *pkt) { return bpf_redirect_map(&dev_redirect_map, 0, 0); } SEC("xdp/devmap") int prog_after_redirect(struct xdp_md *pkt) { bpf_printk("ifindex %i", pkt->ingress_ifindex); return XDP_PASS; } depends on access to rxq, so a NULL pointer gets dereferenced: [ 574.475170] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 574.475188] #PF: supervisor read access in kernel mode [ 574.475194] #PF: error_code(0x0000) - not-present page [ 574.475199] PGD 0 P4D 0 [ 574.475207] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI [ 574.475217] CPU: 4 UID: 0 PID: 217 Comm: kworker/4:1 Not tainted 6.11.0-rc5-reduced-00859-g780801200300 #23 [ 574.475226] Hardware name: Intel(R) Client Systems NUC13ANHi7/NUC13ANBi7, BIOS ANRPL357.0026.2023.0314.1458 03/14/2023 [ 574.475231] Workqueue: mld mld_ifc_work [ 574.475247] RIP: 0010:bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c [ 574.475257] Code: cc cc cc cc cc cc cc 80 00 00 00 cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 57 20 8b 52 00 8b 92 e0 00 00 00 48 bf f8 a6 d5 c4 5d a0 ff ff be 0b [ 574.475263] RSP: 0018:ffffa62440280c98 EFLAGS: 00010206 [ 574.475269] RAX: ffffa62440280cd8 RBX: 0000000000000001 RCX: 0000000000000000 [ 574.475274] RDX: 0000000000000000 RSI: ffffa62440549048 RDI: ffffa62440280ce0 [ 574.475278] RBP: ffffa62440280c98 R08: 0000000000000002 R09: 0000000000000001 [ 574.475281] R10: ffffa05dc8b98000 R11: ffffa05f577fca40 R12: ffffa05dcab24000 [ 574.475285] R13: ffffa62440280ce0 R14: ffffa62440549048 R15: ffffa62440549000 [ 574.475289] FS: 0000000000000000(0000) GS:ffffa05f4f700000(0000) knlGS:0000000000000000 [ 574.475294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 574.475298] CR2: 0000000000000000 CR3: 000000025522e000 CR4: 0000000000f50ef0 [ 574.475303] PKRU: 55555554 [ 574.475306] Call Trace: [ 574.475313] [ 574.475318] ? __die+0x23/0x70 [ 574.475329] ? page_fault_oops+0x180/0x4c0 [ 574.475339] ? skb_pp_cow_data+0x34c/0x490 [ 574.475346] ? kmem_cache_free+0x257/0x280 [ 574.475357] ? exc_page_fault+0x67/0x150 [ 574.475368] ? asm_exc_page_fault+0x26/0x30 [ 574.475381] ? bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c [ 574.475386] bq_xmit_all+0x158/0x420 [ 574.475397] __dev_flush+0x30/0x90 [ 574.475407] veth_poll+0x216/0x250 [veth] [ 574.475421] __napi_poll+0x28/0x1c0 [ 574.475430] net_rx_action+0x32d/0x3a0 [ 574.475441] handle_softirqs+0xcb/0x2c0 [ 574.475451] do_softirq+0x40/0x60 [ 574.475458] [ 574.475461] [ 574.475464] __local_bh_enable_ip+0x66/0x70 [ 574.475471] __dev_queue_xmit+0x268/0xe40 [ 574.475480] ? selinux_ip_postroute+0x213/0x420 [ 574.475491] ? alloc_skb_with_frags+0x4a/0x1d0 [ 574.475502] ip6_finish_output2+0x2be/0x640 [ 574.475512] ? nf_hook_slow+0x42/0xf0 [ 574.475521] ip6_finish_output+0x194/0x300 [ 574.475529] ? __pfx_ip6_finish_output+0x10/0x10 [ 574.475538] mld_sendpack+0x17c/0x240 [ 574.475548] mld_ifc_work+0x192/0x410 [ 574.475557] process_one_work+0x15d/0x380 [ 574.475566] worker_thread+0x29d/0x3a0 [ 574.475573] ? __pfx_worker_thread+0x10/0x10 [ 574.475580] ? __pfx_worker_thread+0x10/0x10 [ 574.475587] kthread+0xcd/0x100 [ 574.475597] ? __pfx_kthread+0x10/0x10 [ 574.475606] ret_from_fork+0x31/0x50 [ 574.475615] ? __pfx_kthread+0x10/0x10 [ 574.475623] ret_from_fork_asm+0x1a/0x ---truncated---
Details
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| linux | — | 6.8.0-58.60 |
| linux-allwinner-5.19 | — | — |
| linux-aws | — | 6.8.0-1027.29 |
| linux-aws-5.0 | — | — |
| linux-aws-5.11 | — | — |
| linux-aws-5.13 | — | — |
| linux-aws-5.15 | — | 5.15.0-1080.87~20.04.1 |
| linux-aws-5.19 | — | — |
| linux-aws-5.3 | — | — |
| linux-aws-5.8 | — | — |
| linux-aws-6.2 | — | — |
| linux-aws-6.5 | — | — |
| linux-aws-6.8 | — | 6.8.0-1027.29~22.04.1 |
| linux-aws-fips | — | 5.15.0-1078.85+fips1 |
| linux-azure | — | 6.8.0-1027.32 |
| linux-azure-5.11 | — | — |
| linux-azure-5.13 | — | — |
| linux-azure-5.15 | — | 5.15.0-1081.90~20.04.1 |
| linux-azure-5.19 | — | — |
| linux-azure-5.3 | — | — |
| linux-azure-5.8 | — | — |
| linux-azure-6.11 | — | 6.11.0-1012.12~24.04.1 |
| linux-azure-6.2 | — | — |
| linux-azure-6.5 | — | — |
| linux-azure-6.8 | — | 6.8.0-1027.32~22.04.1 |
| linux-azure-edge | — | — |
| linux-azure-fde | — | 5.15.0-1081.90.1 |
| linux-azure-fde-5.19 | — | — |
| linux-azure-fde-6.2 | — | — |
| linux-azure-fips | — | 5.15.0-1080.89+fips1 |
| linux-azure-nvidia | — | 6.8.0-1014.15 |
| linux-bluefield | — | — |
| linux-fips | — | 6.8.0-78.78+fips1 |
| linux-gcp | — | 6.8.0-1028.30 |
| linux-gcp-5.11 | — | — |
| linux-gcp-5.13 | — | — |
| linux-gcp-5.15 | — | 5.15.0-1077.86~20.04.1 |
| linux-gcp-5.19 | — | — |
| linux-gcp-5.3 | — | — |
| linux-gcp-5.8 | — | — |
| linux-gcp-6.11 | — | 6.11.0-1011.11~24.04.1 |
| linux-gcp-6.2 | — | — |
| linux-gcp-6.5 | — | — |
| linux-gcp-6.8 | — | 6.8.0-1028.30~22.04.1 |
| linux-gcp-fips | — | 5.15.0-1077.86+fips1 |
| linux-gke | — | 6.8.0-1023.27 |
| linux-gke-4.15 | — | — |
| linux-gke-5.15 | — | — |
| linux-gke-5.4 | — | — |
| linux-gkeop | — | 6.8.0-1010.12 |
| linux-gkeop-5.15 | — | — |
| linux-gkeop-5.4 | — | — |
| linux-hwe | — | — |
| linux-hwe-5.11 | — | — |
| linux-hwe-5.13 | — | — |
| linux-hwe-5.15 | — | 5.15.0-134.145~20.04.1 |
| linux-hwe-5.19 | — | — |
| linux-hwe-5.8 | — | — |
| linux-hwe-6.2 | — | — |
| linux-hwe-6.5 | — | — |
| linux-hwe-6.8 | — | 6.8.0-58.60~22.04.1 |
| linux-hwe-edge | — | — |
| linux-ibm | — | 6.8.0-1024.24 |
| linux-ibm-5.15 | — | 5.15.0-1074.77~20.04.1 |
| linux-ibm-6.8 | — | 6.8.0-1024.24~22.04.1 |
| linux-intel-5.13 | — | — |
| linux-intel-iot-realtime | — | 5.15.0-1071.73 |
| linux-intel-iotg | — | 5.15.0-1073.79 |
| linux-intel-iotg-5.15 | — | 5.15.0-1073.79~20.04.2 |
| linux-kvm | — | 5.15.0-1076.81 |
| linux-lowlatency | — | 6.8.0-58.60.1 |
| linux-lowlatency-hwe-5.15 | — | 5.15.0-133.143~20.04.1 |
| linux-lowlatency-hwe-5.19 | — | — |
| linux-lowlatency-hwe-6.2 | — | — |
| linux-lowlatency-hwe-6.5 | — | — |
| linux-lowlatency-hwe-6.8 | — | 6.8.0-58.60.1~22.04.1 |
| linux-nvidia | — | 6.8.0-1026.29 |
| linux-nvidia-6.11 | — | 6.11.0-1007.7 |
| linux-nvidia-6.2 | — | — |
| linux-nvidia-6.5 | — | — |
| linux-nvidia-6.8 | — | 6.8.0-1026.29~22.04.1 |
| linux-nvidia-lowlatency | — | 6.8.0-1026.29.1 |
| linux-nvidia-tegra | — | 6.8.0-1008.8 |
| linux-nvidia-tegra-5.15 | — | 5.15.0-1039.39~20.04.1 |
| linux-nvidia-tegra-igx | — | 5.15.0-1021.21 |
| linux-oem | — | — |
| linux-oem-5.10 | — | — |
| linux-oem-5.13 | — | — |
| linux-oem-5.14 | — | — |
| linux-oem-5.17 | — | — |
| linux-oem-5.6 | — | — |
| linux-oem-6.0 | — | — |
| linux-oem-6.1 | — | — |
| linux-oem-6.11 | — | 6.11.0-1015.15 |
| linux-oem-6.5 | — | — |
| linux-oem-6.8 | — | 6.8.0-1026.26 |
| linux-oracle | — | 6.8.0-1024.25 |
| linux-oracle-5.0 | — | — |
| linux-oracle-5.11 | — | — |
| linux-oracle-5.13 | — | — |
| linux-oracle-5.15 | — | 5.15.0-1075.81~20.04.1 |
| linux-oracle-5.3 | — | — |
| linux-oracle-5.8 | — | — |
| linux-oracle-6.5 | — | — |
| linux-oracle-6.8 | — | 6.8.0-1024.25~22.04.1 |
| linux-raspi | — | 6.8.0-1028.32 |
| linux-raspi-realtime | — | 6.8.0-2023.24 |
| linux-raspi2 | — | — |
| linux-realtime | — | 6.8.1-1020.21 |
| linux-realtime-6.8 | — | 6.8.1-1020.21~22.04.1 |
| linux-riscv | — | 6.8.0-58.60.1 |
| linux-riscv-5.11 | — | — |
| linux-riscv-5.15 | — | 5.15.0-1073.77~20.04.1 |
| linux-riscv-5.19 | — | — |
| linux-riscv-5.8 | — | — |
| linux-riscv-6.5 | — | — |
| linux-riscv-6.8 | — | 6.8.0-58.60.1~22.04.1 |
| linux-starfive-5.19 | — | — |
| linux-starfive-6.2 | — | — |
| linux-starfive-6.5 | — | — |
| linux-xilinx | — | 6.8.0-1017.18 |
| linux-xilinx-zynqmp | — | 5.15.0-1044.48 |
References
Similar Threats
- Unknown CGA-23jx-hhcx-m389
- Unknown CGA-2qp7-6757-fmgc
- Unknown CGA-2rj5-jc55-r267
- Unknown CGA-3m96-cwq8-6xmx
- Unknown CGA-3qj9-973w-fh9g
Free Vulnerability Check
Is your WordPress site affected?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
