CVE-2025-40078 In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr…
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux 6.18 | premières → < 6.18 | 6.18 |
| Linux 6.17 | premières → < 6.17.3 | 6.17.3 |
| Linux 6.12 | premières → < 6.12.53 | 6.12.53 |
| Linux 6.6 | premières → < 6.6.112 | 6.6.112 |
| Linux 6.1 | premières → < 6.1.156 | 6.1.156 |
| Linux 5.15 | premières → < 5.15.195 | 5.15.195 |
| Linux 5.10 | premières → < 5.10.246 | 5.10.246 |
| Linux 5.4 | premières → < 5.4.301 | 5.4.301 |
| Linux | 4.18 | Pas de correctif indiqué |
Afficher les 3 autres branches Masquer les 3 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.7 → dernières | Pas de correctif indiqué |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.7 → dernières | Pas de correctif indiqué |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.7 → dernières | Pas de correctif indiqué |