Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]bpf: Fix KASAN use-after-free Read in compute_effective_progs[EOL][EOL]Syzbot found a Use After Free bug in compute_effective_progs().[EOL]The reproducer creates a number of BPF links, and causes a fault[EOL]injected alloc to fail, while calling bpf_link_detach on them.[EOL]Link detach triggers the link to be freed by bpf_link_free(),[EOL]which calls __cgroup_bpf_detach() and update_effective_progs().[EOL]If the memory allocation in this function fails, the function restores[EOL]the pointer to the bpf_cgroup_link on the cgroup list, but the memory[EOL]gets freed just after it returns. After this, every subsequent call to[EOL]update_effective_progs() causes this already deallocated pointer to be[EOL]dereferenced in prog_list_length(), and triggers KASAN UAF error.[EOL][EOL]To fix this issue don't preserve the pointer to the prog or link in the[EOL]list, but remove it and replace it with a dummy prog without shrinking[EOL]the table. The subsequent call to __cgroup_bpf_detach() or[EOL]__cgroup_bpf_detach() will correct it.

CREATE(Triage):(User=lchen-cn) [CVE-2022-50219 (https://nvd.nist.gov/vuln/detail/CVE-2022-50219)