Bug 2031183 (CVE-2018-25020)

Summary:	CVE-2018-25020 kernel: long jump over an instruction sequence can lead to overflow in the BPF subsystem
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bdettelb, bhu, blc, brdeoliv, bskeggs, chwhite, crwood, dhoward, dvlasenk, fhrbata, fpacheco, hdegoede, hkrzesin, jarod, jarodwilson, jburrell, jeremy, jfaracco, jforbes, jglisse, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, security-response-team, steved, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A buffer overflow flaw in the Linux kernel BPF subsystem was found in the way users run BPF with long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. A local user could use this flaw to crash the system or escalate their privileges on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-16 22:26:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2031184
Bug Blocks:	2031185

Description Guilherme de Almeida Suckevicz 2021-12-10 17:49:45 UTC

The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c.

Reference and upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=050fad7c4534c13c8eb1d9c2ba66012e014773cb

Comment 1 Guilherme de Almeida Suckevicz 2021-12-10 17:50:48 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2031184]

Comment 2 Justin M. Forbes 2021-12-13 20:14:53 UTC

This was fixed in 4.17 upstream so has not impacted Fedora in years.

Comment 4 Product Security DevOps Team 2021-12-16 22:26:10 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-25020