Linux ARM64 BPF JIT Heap Buffer Overflow Fix with KASAN

From this webpage screenshot, we can extract the following key information about the vulnerability: 1. Vulnerability Description: - Title: bpf, arm64: Fix address emission with tag-based KASAN enabled - Issue: When BPF_TRAMP_F_CALL_ORIG is enabled, the address of the bpf_tramp_image structure on the stack is passed during the size calculation phase, while the address on the heap is passed during the code generation phase. This could lead to a heap buffer overflow, as emit_a64_mov_i64() generates longer code during the size calculation phase but not during code generation. - Solution: The issue is resolved by assuming the worst-case scenario (4 instructions) when calculating the size of the bpf_tramp_image address. 2. Fix History: - Upstream Commit: a552e2ef5fd1a6c78267cd4ec5a9b49aa11bb1c - Fixer: Peter Collingbourne - Commit Time: 2024-10-18 15:16:43 -0700 - Committer: Greg Kroah-Hartman - Commit Time: 2024-11-01 02:02:35 +0100 3. Fixed File: - File Path: arch/arm64/net/bpf_jit_comp.c - File Content: Displays a code snippet showing modifications to the emit_a64_mov_i64() function to address the heap buffer overflow issue. 4. Fix Details: - Code Change: Within the if (flags & BPF_TRAMP_F_CALL_ORIG) block, the call to emit_a64_mov_i64() was modified to resolve the heap buffer overflow problem. 5. Fix Status: - Status: Fixed - Fixers: - Peter Collingbourne - Daniel Borkmann - Xu Kuohai - Sasha Levin This information helps us understand the vulnerability's background, the fix process, and the current status after the patch.

Goal Reached Thanks to every supporter — we hit 100%!

Linux ARM64 BPF JIT Heap Buffer Overflow Fix with KASAN