linux-cve-announce - CVE-2025-22048: LoongArch: BPF: Don't override subprog's return value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025041602-CVE-2025-22048-4738@gregkh>
Date: Wed, 16 Apr 2025 16:12:19 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-22048: LoongArch: BPF: Don't override subprog's return value

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Don't override subprog's return value

The verifier test `calls: div by 0 in subprog` triggers a panic at the
ld.bu instruction. The ld.bu insn is trying to load byte from memory
address returned by the subprog. The subprog actually set the correct
address at the a5 register (dedicated register for BPF return values).
But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values")
we also sign extended a5 to the a0 register (return value in LoongArch).
For function call insn, we later propagate the a0 register back to a5
register. This is right for native calls but wrong for bpf2bpf calls
which expect zero-extended return value in a5 register. So only move a0
to a5 for native calls (i.e. non-BPF_PSEUDO_CALL).

The Linux kernel CVE team has assigned CVE-2025-22048 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.64 with commit 0c8d50501bc13cacecc19caaddc10db372592a39 and fixed in 6.6.87 with commit 7df2696256a034405d3c5a71b3a4c54725de4404
	Issue introduced in 6.12.2 with commit d5d83242a1d778ceb6d8b07c6b491cf7483ca112 and fixed in 6.12.23 with commit 223d565d8892481684091cfbaf3466f2b0e289d3
	Issue introduced in 6.13 with commit 73c359d1d356cf10236ccd358bd55edab33e9424 and fixed in 6.13.11 with commit 780628a780b622759d9e5adc76d15432144da1a3
	Issue introduced in 6.13 with commit 73c359d1d356cf10236ccd358bd55edab33e9424 and fixed in 6.14.2 with commit 996e90ab446641553e8e21707b38b9709605e0e0
	Issue introduced in 6.13 with commit 73c359d1d356cf10236ccd358bd55edab33e9424 and fixed in 6.15-rc1 with commit 60f3caff1492e5b8616b9578c4bedb5c0a88ed14
	Issue introduced in 6.1.120 with commit 8382e92f90b601acf6d426121e6f4991502e767d
	Issue introduced in 6.11.11 with commit 3b75f627b73d96787a493e2f1187543ba9c056a4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-22048
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/loongarch/net/bpf_jit.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7df2696256a034405d3c5a71b3a4c54725de4404
	https://git.kernel.org/stable/c/223d565d8892481684091cfbaf3466f2b0e289d3
	https://git.kernel.org/stable/c/780628a780b622759d9e5adc76d15432144da1a3
	https://git.kernel.org/stable/c/996e90ab446641553e8e21707b38b9709605e0e0
	https://git.kernel.org/stable/c/60f3caff1492e5b8616b9578c4bedb5c0a88ed14