title: bpf: fix check for attempt to corrupt spilled pointer
description: In the Linux kernel, the following vulnerability has been resolved:
bpf: fix check for attempt to corrupt spilled pointer
When register is spilled onto a stack as a 1/2/4-byte register, we set
slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it,
depending on actual spill size). So to check if some stack slot has
spilled register we need to consult slot_type[7], not slot_type[0].
To avoid the need to remember and double-check this in the future, just
use is_spilled_reg() helper.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: cdd73a5ed084, lessThan: 2757f17972d8, status: affected, versionType: git
version: 07c286c10a9c, lessThan: 67e6707f0735, status: affected, versionType: git
version: 27113c59b6d0, lessThan: fc3e3c50a0a4, status: affected, versionType: git
version: 27113c59b6d0, lessThan: 8dc15b067059, status: affected, versionType: git
version: 27113c59b6d0, lessThan: 40617d45ea05, status: affected, versionType: git
version: 27113c59b6d0, lessThan: ab125ed3ec1c, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.16, status: affected
version: 0, lessThan: 5.16, status: unaffected, versionType: custom
version: 5.10.209, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.148, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.75, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.14, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.2, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
