CVE-2023-54181

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix issue in verifying allow_ptr_leaks

After we converted the capabilities of our networking-bpf program from

cap_sys_admin to cap_net_admin+cap_bpf, our networking-bpf program

failed to start. Because it failed the bpf verifier, and the error log

is "R3 pointer comparison prohibited".

A simple reproducer as follows,

SEC("cls-ingress")

int ingress(struct __sk_buff *skb)

{

struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);

if ((long)(iph + 1) > (long)skb->data_end)

return TC_ACT_STOLEN;

return TC_ACT_OK;

}

Per discussion with Yonghong and Alexei [1], comparison of two packet

pointers is not a pointer leak. This patch fixes it.

Our local kernel is 6.1.y and we expect this fix to be backported to

6.1.y, so stable is CCed.

[1]. https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References