Buffer Overflow in Linux Kernel BPF

Executive Summary

This vulnerability exists in the Linux kernel's BPF subsystem, specifically in the function bpf_prog_test_run_skb(). The function calls eth_type_trans() and then uses skb->protocol to initialize socket family and address fields for testing. However, for IPv4 and IPv6 packets, it may attempt to access the IP header (ip_hdr or ipv6_hdr) even when the provided test input only contains an Ethernet header, which is insufficient.

The issue arises because the function does not properly check if the Layer 3 (L3) header is long enough before accessing it. This can lead to accessing invalid memory when the Ethernet frame carries an IPv4 or IPv6 EtherType but the L3 header is too short.

The fix involves rejecting such short IPv4/IPv6 inputs earlier by folding the header length checks into the existing protocol switch and returning an error (-EINVAL) before accessing the network headers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to improper handling of malformed or insufficient network packet inputs in the Linux kernel's BPF testing function. If exploited, it may cause the kernel to access invalid memory regions, potentially leading to kernel crashes or denial of service.

While the description does not explicitly mention privilege escalation or code execution, such memory access issues in kernel space can be serious and may affect system stability and security.

Useful 0 Not Useful 0