CVE-2021-47303

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Track subprog poke descriptors correctly and fix use-after-free

Subprograms are calling map_poke_track(), but on program release there is no

hook to call map_poke_untrack(). However, on program release, the aux memory

(and poke descriptor table) is freed even though we still have a reference to

it in the element list of the map aux data. When we run map_poke_run(), we then

end up accessing free'd memory, triggering KASAN in prog_array_map_poke_run():

[...]

[ 402.824689] BUG: KASAN: use-after-free in prog_array_map_poke_run+0xc2/0x34e

[ 402.824698] Read of size 4 at addr ffff8881905a7940 by task hubble-fgs/4337

[ 402.824705] CPU: 1 PID: 4337 Comm: hubble-fgs Tainted: G I 5.12.0+ #399

[ 402.824715] Call Trace:

[ 402.824719] dump_stack+0x93/0xc2

[ 402.824727] print_address_description.constprop.0+0x1a/0x140

[ 402.824736] ? prog_array_map_poke_run+0xc2/0x34e

[ 402.824740]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References