ACK: [Bionic][SRU][PATCH 1/1] bpf: 32-bit RSH verification must truncate input before the ALU op

[Tyler Hicks]

On 2018-11-23 11:46:54, Po-Hsu Lin wrote:
> From: Jann Horn <jannh at google.com>
> 
> CVE-2018-18445
> 
> When I wrote commit 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification"), I
> assumed that, in order to emulate 64-bit arithmetic with 32-bit logic, it
> is sufficient to just truncate the output to 32 bits; and so I just moved
> the register size coercion that used to be at the start of the function to
> the end of the function.
> 
> That assumption is true for almost every op, but not for 32-bit right
> shifts, because those can propagate information towards the least
> significant bit. Fix it by always truncating inputs for 32-bit ops to 32
> bits.
> 
> Also get rid of the coerce_reg_to_size() after the ALU op, since that has
> no effect.
> 
> Fixes: 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification")
> Acked-by: Daniel Borkmann <daniel at iogearbox.net>
> Signed-off-by: Jann Horn <jannh at google.com>
> Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
> (cherry picked from commit b799207e1e1816b09e7a5920fbb2d5fcf6edd681)
> Signed-off-by: Po-Hsu Lin <po-hsu.lin at canonical.com>

Acked-by: Tyler Hicks <tyhicks at canonical.com>

Thanks!

Tyler
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20181127/4418e001/attachment.sig>