PT-2026-116862 · Linux · Linux
CVE-2026-98643
·
تاريخ النشر
2026-10-18
·
تاريخ التحديث
2026-10-18
لا يوجد
لا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix out-of-bounds read of rtt min in sock ops
A sockops prog reading skops->rtt min never checks the sk type: on the
tcp conn request() path sock ops->sk is a request sock (non-full), and the
ctx rewrite casts it to a tcp sock (full) and reads rtt min past the end of
the request sock, returning dirty adjacent memory.
SEC("sockops")
int prog(struct bpf sock ops *skops)
{
switch (skops->op) {
case BPF SOCK OPS RWND INIT:
leak = skops->rtt min; /* reads the request sock OOB */
...
}
}For instance one such read returned rtt min=0xffff8881, the high half of a
leaked kernel pointer.
Guarding that cast is exactly what SOCK OPS GET FIELD() does -- it checks
is locked tcp sock and returns 0 when sock ops->sk is not a locked full
socket. Every other tcp sock field in sock ops goes through it; rtt min is
the only one open-coded, so it skips the check.
Read rtt min through SOCK OPS GET FIELD() too. rtt min is a bit special:
it is a struct minmax and we only want the current min, so pass
rtt min.s[0].v. That is equivalent to the old hand-computed offset
offsetof(struct tcp sock, rtt min) + sizeof field(struct minmax sample, t)(s[0] sits at rtt min + 0 and .v at + sizeof(.t), i.e. what minmax get()
returns), so the loaded field is unchanged and only the full-sock guard is
added. The two BUILD BUG ON()s that protected the hand-computed offset
are no longer needed.
Before patch:
0: r1 = *(u64 *)(r1 +0) ; r1 = skops->sk
1: r1 = *(u32 *)(r1 +2324) ; ((tcp sock *)sk)->rtt min.s[0].vAfter patch:
0: *(u64 *)(r1 +56) = r9
1: r9 = *(u8 *)(r1 +50) ; is locked tcp sock
2: if r9 == 0 goto pc+4 ; not a locked full sock -> 0
3: r9 = *(u64 *)(r1 +56)
4: r1 = *(u64 *)(r1 +0) ; r1 = skops->sk
5: r1 = *(u32 *)(r1 +2324) ; rtt min.s[0].v
6: goto pc+2
7: r9 = *(u64 *)(r1 +56)
8: r1 = 0 وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Linux