Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

bpf: Reject narrower access to pointer ctx fields (Linux Linux)

CVE-2025-38591
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.21 % · percentile 11 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Search on…

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_narrower_load" case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning: verifier bug: error during ctx access conversion(1) This patch fixes that to return a proper "invalid bpf_context access off=X size=Y" error on the load instruction. The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency. Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 7847c4140e06f6e87229faae22cc38525334c156 ; affected f96da09473b52c09125cc9bf7d7d4576ae8229e0 < feae34c992eb7191862fb1594c704fbbf650fef8 ; affected f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 33660d44e789edb4f303210c813fc56d56377a90 ; affected f96da09473b52c09125cc9bf7d7d4576ae8229e0 < e2e9599f3503df7cf3569d2b6c50d5488fb59435 ; affected f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 058a0da4f6d916a79b693384111bb80a90d73763 ; affected f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 202900ceeef67458c964c2af6e1427c8e533ea7c
Linux · Linuxaffected 4.13 ; unaffected 0 < 4.13 ; unaffected 5.10.249 ≤ 5.10.* ; unaffected 5.15.199 ≤ 5.15.* ; unaffected 6.1.162 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD