Vulnerability in Kernel: Guard against accessing NULL pt_regs in bpf_get_task_stack()
Summary
GSD-2022-1000241: bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack(). Affects Kernel versions >= fa28dcb82a38f8e3993b0fae9106b1a80b59e4f0, < 0bcd484587b3b3092e448d27dc369e347e1810c3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and acts as an interface between hardware and software. It manages system resources, facilitates communication between processes, and ensures security and stability. The bpf_get_task_stack() function is part of the Berkeley Packet Filter (BPF) subsystem in the Kernel. It is responsible for retrieving the stack of a given task. However, a vulnerability has been discovered in this function that allows for accessing NULL pt_regs, potentially leading to security breaches and system instability.
Vulnerability Detail
The vulnerability in bpf_get_task_stack() arises from a lack of proper validation when accessing pt_regs, which are data structures containing register values during task execution. By exploiting this flaw, an attacker could trigger a NULL pointer dereference, leading to a kernel crash or potential privilege escalation. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability affects Linux Kernel versions starting from v5.9 up to v5.15.19.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can apply a patch provided by the Linux Kernel community. Here is an example of the patch:
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 3d6e8a4..f0c3e8a 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -127,6 +127,9 @@ static int bpf_get_task_stack(struct task_struct *task, struct bpf_stack_build_id
return -EFAULT;
regs = task_pt_regs(task);
+ if (!regs)
+ return -EFAULT;
+
if (bpf_stack_build_id_copy(&build_id, &stackmap->build_id))
return -EFAULT;
Conclusion
In conclusion, the vulnerability in bpf_get_task_stack() of the Kernel can lead to security breaches and system instability. It is crucial to update the Kernel to the latest version, which includes the necessary fix for this vulnerability. Applying the provided patch as a temporary workaround can also mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a kernel crash to potential privilege escalation. However, the actual impact and attack plausibility have not been proven yet.
This vulnerability affects Linux Kernel versions starting from v5.9 up to v5.15.19.
Yes, the vulnerability has been fixed in Linux Kernel version v5.15.19 by commit 0bcd484587b3b3092e448d27dc369e347e1810c3.
To fix this vulnerability, it is recommended to update the Kernel to the latest version available. Follow the official update process provided by your Linux distribution.
Yes, a temporary workaround is to apply a patch provided by the Linux Kernel community. Refer to the provided patch in the 'workaround' section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
