oss-security - Re: Linux >=4.9: eBPF memory corruption bugs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 23 Dec 2017 09:10:28 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Linux >=4.9: eBPF memory corruption bugs

Hi

MITRE has assigned 6 more CVEs for:

CVE-2017-17857 [bpf: fix missing error return in check_stack_boundary()]
Fixed by: https://git.kernel.org/linus/ea25f914dc164c8d56b36147ecc86bc65f83c469

CVE-2017-17856 [bpf: force strict alignment checks for stack pointers]
Fixed by: https://git.kernel.org/linus/a5ec6ae161d72f01411169a938fa5f8baea16e8f

CVE-2017-17855 [bpf: don't prune branches when a scalar is replaced with a pointer]
Fixed by: https://git.kernel.org/linus/179d1c5602997fef5a940c6ddcf31212cbfebd14

CVE-2017-17854 [bpf: fix integer overflows]
Fixed by: https://git.kernel.org/linus/bb7f0f989ca7de1153bd128a40a71709e339fa03

CVE-2017-17853 [bpf/verifier: fix bounds calculation on BPF_RSH]
Fixed by: https://git.kernel.org/linus/4374f256ce8182019353c0c639bb8d0695b4c941

CVE-2017-17852 [bpf: fix 32-bit ALU op verification]
Fixed by: https://git.kernel.org/linus/468f6eafa6c44cb2c5d8aad35e12f06c240a812a

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.