Описание
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stack slot index in nospec checks
check_stack_write_fixed_off() computes the byte slot for a fixed-offset
stack write as -off - 1, and records each written byte in slot_type[] with
(slot - i) % BPF_REG_SIZE.
The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a
4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the
pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates
bytes 7..4. That can leave the second half-slot write without nospec_result
even though the bytes being overwritten still require sanitization.
Use the same slot index in the sanitization pre-check that the write path uses
when updating slot_type[].
A flaw was found in the Berkeley Packet Filter (BPF) component of the Linux kernel. An incorrect calculation of the stack slot index during Spectre v4 sanitization checks could result in certain memory bytes not being properly sanitized. This vulnerability might allow an attacker to potentially disclose sensitive information through speculative execution side-channel attacks.
Отчет
A moderate information disclosure flaw was found in the Berkeley Packet Filter (BPF) verifier of the Linux kernel as shipped in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2. When checking fixed-offset stack writes, check_stack_write_fixed_off() computes the byte slot as -off - 1 and records each written byte in slot_type[] using (slot - i) % BPF_REG_SIZE, but the Spectre v4 (speculative store bypass) sanitization pre-check reads slot_type[i] instead. For a partial write, such as a 4-byte write at fp-8 after the lower half of the slot has been zeroed, the pre-check scans the wrong bytes and may leave the overwritten stack bytes without nospec_result sanitization. A local attacker able to load a crafted BPF program, which typically requires CAP_BPF/CAP_SYS_ADMIN or an environment where unprivileged BPF is enabled, could potentially exploit this gap to disclose sensitive kernel stack data through a Spectre v4 speculative-execution side-channel attack. Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt) and the RHEL 8.4 streams are not affected because the vulnerable code is not present there; the affected code first appeared in RHEL 8.5. The flaw has been assessed as moderate because exploitation requires local access, BPF program-loading capability, and a complex, timing-dependent side channel, so practical exploitability is limited. Based on this limited practical exposure, the fix has been deferred and will be delivered in a future scheduled kernel update rather than an immediate security update; the residual risk until then is potential local disclosure of unsanitized kernel stack memory through a Spectre v4 side channel by an attacker with the ability to load crafted BPF programs.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE. The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization. Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE. The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization. Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].
In the Linux kernel, the following vulnerability has been resolved: b ...
5.5 Medium
CVSS3