Bug 2054865 (CVE-2021-45402)

Summary:	CVE-2021-45402 kernel: pointer leak in check_alu_op() of kernel/bpf/verifier.c
Product:	[Other] Security Response	Reporter:	Todd Cullum <tcullum>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bdettelb, bhu, blc, chwhite, crwood, dvlasenk, hdegoede, hkrzesin, jarod, jarodwilson, jburrell, jeremy, jfaracco, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steved, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Linux kernel 5.16-rc6	Doc Type:	If docs needed, set a value
Doc Text:	A memory leak flaw was found in the Linux kernel’s BPF subsystem in the way a user triggers the check_alu_op function of the BPF verifier. This flaw allows a local user to obtain unauthorized memory access or potentially crash the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2055321, 2055397, 2055398, 2055399, 2055400
Bug Blocks:	2054862

Description Todd Cullum 2022-02-15 20:43:45 UTC

The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."

Commits:
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b1a7288dedc6caf9023f2676b4f5ed34cf0d4029
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=3cf2b61eb06765e27fec6799292d9fb46d0b7e60
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=e572ff80f05c33cd0cb4860f864f5c9c044280b6

Comment 2 Alex 2022-02-16 17:15:27 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2055321]

Comment 5 Justin M. Forbes 2022-02-17 21:57:26 UTC

This was fixed for Fedora with the 5.15.11 stable kernel updates.