CVE-2021-46974
bpf: Fix masking negation logic upon negative dst register
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix masking negation logic upon negative dst register
The negation logic for the case where the off_reg is sitting in the
dst register is not correct given then we cannot just invert the add
to a sub or vice versa. As a fix, perform the final bitwise and-op
unconditionally into AX from the off_reg, then move the pointer from
the src to dst and finally use AX as the source for the original
pointer arithmetic operation such that the inversion yields a correct
result. The single non-AX mov in between is possible given constant
blinding is retaining it as it's not an immediate based operation.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: corrige la lógica de negación de enmascaramiento en el registro dst negativo. La lógica de negación para el caso en el que off_reg se encuentra en el registro dst no es correcta, dado que entonces no podemos simplemente invertir la adición a un sub o viceversa. Como solución, realice la operación final bit a bit incondicionalmente en AX desde off_reg, luego mueva el puntero de src a dst y finalmente use AX como fuente para la operación aritmética del puntero original de modo que la inversión produzca un resultado correcto. El único movimiento que no sea AX en el medio es posible dado que el cegamiento constante lo retiene, ya que no es una operación inmediata.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-27 CVE Reserved
- 2024-02-27 CVE Published
- 2024-02-28 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/ae03b6b1c880a03d4771257336dc3bca156dd51b | Vuln. Introduced | |
| https://git.kernel.org/stable/c/f92a819b4cbef8c9527d9797110544b2055a4b96 | Vuln. Introduced | |
| https://git.kernel.org/stable/c/979d63d50c0c0f7bc537bf821e056cc9fe5abd38 | Vuln. Introduced | |
| https://git.kernel.org/stable/c/078da99d449f64ca04d459cdbdcce513b64173cd | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.14.113 < 4.14.233 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.14.113 < 4.14.233" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.19.19 < 4.19.190 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19.19 < 4.19.190" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.4.117 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.4.117" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.10.35 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.10.35" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.11.19 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.11.19" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.12.2 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.12.2" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.13 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.13" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.20.6 Search vendor "Linux" for product "Linux Kernel" and version "4.20.6" | en |
Affected
| ||||||