CVE-2024-53125

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: sync_linked_regs() must preserve subreg_def

Range propagation must not affect subreg_def marks, otherwise the

following example is rewritten by verifier incorrectly when

BPF_F_TEST_RND_HI32 flag is set:

0: call bpf_ktime_get_ns call bpf_ktime_get_ns

1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff

2: w1 = w0 rewrites w1 = w0

3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r)

4: r1 >>= 32 r11 <<= 32 (r)

5: r0 = r1 r1 |= r11 (r)

6: exit; if w0 < 0xa goto pc+0

r1 >>= 32

r0 = r1

exit

(or zero extension of w1 at (2) is missing for architectures that

require zero extension for upper reg

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References