Linux: fprobe: Terminate the fgraph_data list when the reservation is not filled
What fixes it
- 1d653a183973f5283a3db5a38cd5e195eb152244LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
fprobe: Terminate the fgraph_data list when the reservation is not filled
fprobe_fgraph_entry() reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns
- fgraph_reserve_data() does not clear the area, so fprobe_return()
parses the unused tail as headers left over from an earlier call, and an exit handler can run twice or despite its entry handler asking to skip it.
Write a zero word after the last entry to terminate the walk. A zeroed slot does not decode to a NULL fprobe on the arches that encode the header into one unsigned long, since arch_decode_fprobe_header_fp() ORs in FPROBE_HEADER_MSB_PATTERN, so make read_fprobe_header() return NULL for a zeroed slot.
Text from CVE List
Affected versions 6
- Linuxaffected: e0a384434ae1bdfb03954c46c464e3dbd3223ad6 before b7459fddcb27a4b7d01067678172afa362cf660dCVE List
- Linuxaffected: e0a384434ae1bdfb03954c46c464e3dbd3223ad6 before 1d653a183973f5283a3db5a38cd5e195eb152244CVE List
- Linuxaffected: 7.1CVE List
- Linuxunaffected: all versions before 7.1CVE List
- Linuxunaffected: 7.2.9 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List