title: Linux kernel bpf verifier incorrect mod32 truncation
description: The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.
problem types: CWE-681: Incorrect Conversion between Numeric Types
affected:
{
product: kernel
vendor: Linux
versions:
lessThan: 5.12-rc1, status: affected, version: trunk, versionType: custom
lessThan: 5.11.2, status: affected, version: 5.11, versionType: custom
lessThan: 5.10.19, status: affected, version: 5.10, versionType: custom
lessThan: 5.4.101, status: affected, version: 5.4, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
solutions: Apply or update to a kernel that contains the commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero").