In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix helper writes to read-only maps
Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT} as arguments.
In check_func_arg() when the argument is as mentioned, the meta->raw_mode is never set. Later, check_helper_mem_access(), under the case of PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the subsequent call to check_map_access_type() and given the BPF map is read-only it succeeds.
The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT when results are written into them as opposed to read out of them. The latter indicates that it's okay to pass a pointer to uninitialized memory as the memory is written to anyway.
However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM just with additional alignment requirement. So it is better to just get rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the fixed size memory types. For this, add MEM_ALIGNED to additionally ensure alignment given these helpers write directly into the args via *<ptr> = val. The .arg*_size has been initialized reflecting the actual sizeof(*<ptr>).
MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated argument types, since in !MEM_FIXED_SIZE cases the verifier does not know the buffer size a priori and therefore cannot blindly write *<ptr> = val.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.238-231.953Upgrade kernel-livepatch-5.10.238-234.956Upgrade kernel-livepatch-5.15.191-132.213Upgrade kernel-debuginfoUpgrade python-perfUpgrade kernel-develUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-tools-debuginfo | Jun 24, 2025 | Oct 21, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade python3-perfUpgrade perfUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-livepatch-6.1.124-134.200 | Feb 17, 2025 | Oct 21, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jan 13, 2025 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade python3-perf | Feb 11, 2025 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perf | Feb 11, 2025 | Oct 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1019-gkeUpgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1020-oracle-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-kvmUpgrade linux-image-aws-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.11.0-1015-oemUpgrade linux-image-6.8.0-54-lowlatencyUpgrade linux-image-6.8.0-57-genericUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-6.8.0-1022-nvidia-64kUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-realtimeUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1025-azureUpgrade linux-image-virtualUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-nvidia-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1020-oracleUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1024-oemUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-6.8.0-1006-gkeopUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1023-awsUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-6.8.0-1024-gcp-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1024-gcpUpgrade linux-image-6.8.0-54-genericUpgrade linux-image-oem-24.04bUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-6.8.0-1019-raspiUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-54-generic-64kUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-6.8.0-1022-nvidiaUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-6.8.0-54-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-oem-22.04aUpgrade linux-image-azure-nvidiaUpgrade linux-image-6.8.0-1022-nvidia-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-6.8.0-1022-nvidia-lowlatency-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-gcp | Feb 20, 2025 | Oct 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub