CVE-2021-47608

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix kernel address leakage in atomic fetch

The change in commit 37086bfdc737 ("bpf: Propagate stack bounds to registers

in atomics w/ BPF_FETCH") around check_mem_access() handling is buggy since

this would allow for unprivileged users to leak kernel pointers. For example,

an atomic fetch/and with -1 on a stack destination which holds a spilled

pointer will migrate the spilled register type into a scalar, which can then

be exported out of the program (since scalar != pointer) by dumping it into

a map value.

The original implementation of XADD was preventing this situation by using

a double call to check_mem_access() one with BPF_READ and a subsequent one

with BPF_WRITE, in both cases passing -1 as a placeholder value instead of

register as per XADD semantics since it didn't contain a value fetch. The

BPF_READ also included a check in check_stack_read_fixed_off() which rejects

the program if the stack slot is of

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References