CVE-2025-38502
published 2025-08-16CVE-2025-38502: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in…
high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix oob access in cgroup local storage
Lonial reported that an out-of-bounds access in cgroup local storage
can be crafted via tail calls. Given two programs each utilizing a
cgroup local storage with a different value size, and one program
doing a tail call into the other. The verifier will validate each of
the indivial programs just fine. However, in the runtime context
the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the
BPF program as well as any cgroup local storage flavor the program
uses. Helpers such as bpf_get_local_storage() pick this up from the
runtime context:
ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);
storage = ctx->prog_item->cgroup_storage[stype];
if (stype == BPF_CGROUP_STORAGE_SHARED)
ptr = &READ_ONCE(storage->buf)->data[0];
else
ptr = this_cpu_ptr(storage->percpu_buf);
For the second program which was called from the originally attached
one, this means bpf_get_local_storage() will pick up the former
program's map, not its own. With mismatching sizes, this can result
in an unintended out-of-bounds access.
To fix this issue, we need to extend bpf_map_owner with an array of
storage_cookie[] to match on i) the exact maps from the original
program if the second program was using bpf_get_local_storage(), or
ii) allow the tail call combination if the second program was not
using any of the cgroup local storage maps.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 7d9c3427894fe70d1347b4820476bf37736d2ff0 < c1c74584b9b4043c52e41fec415226e582d266a3 | c1c74584b9b4043c52e41fec415226e582d266a3 |
| linux | linux | >= 7d9c3427894fe70d1347b4820476bf37736d2ff0 < 66da7cee78590259b400e51a70622ccd41da7bb2 | 66da7cee78590259b400e51a70622ccd41da7bb2 |
| linux | linux | >= 7d9c3427894fe70d1347b4820476bf37736d2ff0 < 7acfa07c585e3d7a64654d38f0a5c762877d0b9b | 7acfa07c585e3d7a64654d38f0a5c762877d0b9b |
| linux | linux | >= 7d9c3427894fe70d1347b4820476bf37736d2ff0 < 41688d1fc5d163a6c2c0e95c0419e2cb31a44648 | 41688d1fc5d163a6c2c0e95c0419e2cb31a44648 |
| linux | linux | >= 7d9c3427894fe70d1347b4820476bf37736d2ff0 < 19341d5c59e8c7e8528e40f8663e99d67810473c | 19341d5c59e8c7e8528e40f8663e99d67810473c |
| linux | linux | >= 7d9c3427894fe70d1347b4820476bf37736d2ff0 < abad3d0bad72a52137e0c350c59542d75ae4f513 | abad3d0bad72a52137e0c350c59542d75ae4f513 |
| linux | linux_kernel | >= 0 < 6.1.153-1 | 6.1.153-1 |
| linux | linux_kernel | >= 0 < 6.12.48-1 | 6.12.48-1 |
| linux | linux_kernel | >= 0 < 6.16.3-1 | 6.16.3-1 |
| linux | linux_kernel | >= 0 < 5.15.0-163.173 | 5.15.0-163.173 |
| linux | linux_kernel | >= 0 < 6.8.0-106.106 | 6.8.0-106.106 |
| linux | linux_kernel | >= 5.16 < 6.1.151 | 6.1.151 |
| linux | linux_kernel | >= 5.9 < 5.15.192 | 5.15.192 |
| linux | linux_kernel | >= 6.13 < 6.16.1 | 6.16.1 |
| linux | linux_kernel | >= 6.2 < 6.6.105 | 6.6.105 |
| linux | linux_kernel | >= 6.7 < 6.12.46 | 6.12.46 |
| msrc | azl3_kernel_6.6.104.2-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.96.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.96.2-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| siemens | simatic_cn_4100_firmware | < 5.0 | 5.0 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH