{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-10T10:44:38.640","vulnerabilities":[{"cve":{"id":"CVE-2021-47300","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2024-05-21T15:15:17.820","lastModified":"2024-12-26T20:44:16.713","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix tail_call_reachable rejection for interpreter when jit failed\n\nDuring testing of f263a81451c1 (\"bpf: Track subprog poke descriptors correctly\nand fix use-after-free\") under various failure conditions, for example, when\njit_subprogs() fails and tries to clean up the program to be run under the\ninterpreter, we ran into the following freeze:\n\n  [...]\n  #127/8 tailcall_bpf2bpf_3:FAIL\n  [...]\n  [   92.041251] BUG: KASAN: slab-out-of-bounds in ___bpf_prog_run+0x1b9d/0x2e20\n  [   92.042408] Read of size 8 at addr ffff88800da67f68 by task test_progs/682\n  [   92.043707]\n  [   92.044030] CPU: 1 PID: 682 Comm: test_progs Tainted: G   O   5.13.0-53301-ge6c08cb33a30-dirty #87\n  [   92.045542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014\n  [   92.046785] Call Trace:\n  [   92.047171]  ? __bpf_prog_run_args64+0xc0/0xc0\n  [   92.047773]  ? __bpf_prog_run_args32+0x8b/0xb0\n  [   92.048389]  ? __bpf_prog_run_args64+0xc0/0xc0\n  [   92.049019]  ? ktime_get+0x117/0x130\n  [...] // few hundred [similar] lines more\n  [   92.659025]  ? ktime_get+0x117/0x130\n  [   92.659845]  ? __bpf_prog_run_args64+0xc0/0xc0\n  [   92.660738]  ? __bpf_prog_run_args32+0x8b/0xb0\n  [   92.661528]  ? __bpf_prog_run_args64+0xc0/0xc0\n  [   92.662378]  ? print_usage_bug+0x50/0x50\n  [   92.663221]  ? print_usage_bug+0x50/0x50\n  [   92.664077]  ? bpf_ksym_find+0x9c/0xe0\n  [   92.664887]  ? ktime_get+0x117/0x130\n  [   92.665624]  ? kernel_text_address+0xf5/0x100\n  [   92.666529]  ? __kernel_text_address+0xe/0x30\n  [   92.667725]  ? unwind_get_return_address+0x2f/0x50\n  [   92.668854]  ? ___bpf_prog_run+0x15d4/0x2e20\n  [   92.670185]  ? ktime_get+0x117/0x130\n  [   92.671130]  ? __bpf_prog_run_args64+0xc0/0xc0\n  [   92.672020]  ? __bpf_prog_run_args32+0x8b/0xb0\n  [   92.672860]  ? __bpf_prog_run_args64+0xc0/0xc0\n  [   92.675159]  ? ktime_get+0x117/0x130\n  [   92.677074]  ? lock_is_held_type+0xd5/0x130\n  [   92.678662]  ? ___bpf_prog_run+0x15d4/0x2e20\n  [   92.680046]  ? ktime_get+0x117/0x130\n  [   92.681285]  ? __bpf_prog_run32+0x6b/0x90\n  [   92.682601]  ? __bpf_prog_run64+0x90/0x90\n  [   92.683636]  ? lock_downgrade+0x370/0x370\n  [   92.684647]  ? mark_held_locks+0x44/0x90\n  [   92.685652]  ? ktime_get+0x117/0x130\n  [   92.686752]  ? lockdep_hardirqs_on+0x79/0x100\n  [   92.688004]  ? ktime_get+0x117/0x130\n  [   92.688573]  ? __cant_migrate+0x2b/0x80\n  [   92.689192]  ? bpf_test_run+0x2f4/0x510\n  [   92.689869]  ? bpf_test_timer_continue+0x1c0/0x1c0\n  [   92.690856]  ? rcu_read_lock_bh_held+0x90/0x90\n  [   92.691506]  ? __kasan_slab_alloc+0x61/0x80\n  [   92.692128]  ? eth_type_trans+0x128/0x240\n  [   92.692737]  ? __build_skb+0x46/0x50\n  [   92.693252]  ? bpf_prog_test_run_skb+0x65e/0xc50\n  [   92.693954]  ? bpf_prog_test_run_raw_tp+0x2d0/0x2d0\n  [   92.694639]  ? __fget_light+0xa1/0x100\n  [   92.695162]  ? bpf_prog_inc+0x23/0x30\n  [   92.695685]  ? __sys_bpf+0xb40/0x2c80\n  [   92.696324]  ? bpf_link_get_from_fd+0x90/0x90\n  [   92.697150]  ? mark_held_locks+0x24/0x90\n  [   92.698007]  ? lockdep_hardirqs_on_prepare+0x124/0x220\n  [   92.699045]  ? finish_task_switch+0xe6/0x370\n  [   92.700072]  ? lockdep_hardirqs_on+0x79/0x100\n  [   92.701233]  ? finish_task_switch+0x11d/0x370\n  [   92.702264]  ? __switch_to+0x2c0/0x740\n  [   92.703148]  ? mark_held_locks+0x24/0x90\n  [   92.704155]  ? __x64_sys_bpf+0x45/0x50\n  [   92.705146]  ? do_syscall_64+0x35/0x80\n  [   92.706953]  ? entry_SYSCALL_64_after_hwframe+0x44/0xae\n  [...]\n\nTurns out that the program rejection from e411901c0b77 (\"bpf: allow for tailcalls\nin BPF subprograms for x64 JIT\") is buggy since env->prog->aux->tail_call_reachable\nis never true. Commit ebf7d1f508a7 (\"bpf, x64: rework pro/epilogue and tailcall\nhandling in JIT\") added a tracker into check_max_stack_depth() which propagates\nthe tail_call_reachable condition throughout the subprograms. This info is then\nassigned to the subprogram's \n---truncated---"},{"lang":"es","value":"En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf: corrige el rechazo de tail_call_reachable para el intérprete cuando falla jit. Durante las pruebas de f263a81451c1 (\"bpf: rastrea correctamente los descriptores de inserción del subprog y corrige el use after free\") bajo varias condiciones de fallo, por Por ejemplo, cuando jit_subprogs() falla e intenta limpiar el programa que se ejecutará bajo el intérprete, nos encontramos con el siguiente congelamiento: [...] #127/8 tailcall_bpf2bpf_3:FAIL [...] [ 92.041251] ERROR: KASAN: slab fuera de los límites en ___bpf_prog_run+0x1b9d/0x2e20 [92.042408] Lectura de tamaño 8 en la dirección ffff88800da67f68 por tarea test_progs/682 [92.043707] [92.044030] CPU: 1 PID: 682 Comm: _progs Contaminado: GO 5.13. 0-53301-ge6c08cb33a30-dirty #87 [92.045542] Nombre del hardware: PC estándar QEMU (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 01/04/2014 [92.046785] Seguimiento de llamadas: [92.047171] ? __bpf_prog_run_args64+0xc0/0xc0 [92.047773]? __bpf_prog_run_args32+0x8b/0xb0 [92.048389]? __bpf_prog_run_args64+0xc0/0xc0 [92.049019]? ktime_get+0x117/0x130 [...] // ¿unos cientos de líneas [similares] más [92.659025]? ktime_get+0x117/0x130 [92.659845]? __bpf_prog_run_args64+0xc0/0xc0 [92.660738]? __bpf_prog_run_args32+0x8b/0xb0 [92.661528]? __bpf_prog_run_args64+0xc0/0xc0 [92.662378]? print_usage_bug+0x50/0x50 [92.663221]? print_usage_bug+0x50/0x50 [92.664077]? bpf_ksym_find+0x9c/0xe0 [92.664887]? ktime_get+0x117/0x130 [92.665624]? kernel_text_address+0xf5/0x100 [92.666529]? __kernel_text_address+0xe/0x30 [ 92.667725] ? unwind_get_return_address+0x2f/0x50 [92.668854]? ___bpf_prog_run+0x15d4/0x2e20 [ 92.670185] ? ktime_get+0x117/0x130 [92.671130]? __bpf_prog_run_args64+0xc0/0xc0 [92.672020]? __bpf_prog_run_args32+0x8b/0xb0 [92.672860]? __bpf_prog_run_args64+0xc0/0xc0 [92.675159]? ktime_get+0x117/0x130 [92.677074]? lock_is_held_type+0xd5/0x130 [92.678662]? ___bpf_prog_run+0x15d4/0x2e20 [ 92.680046] ? ktime_get+0x117/0x130 [92.681285]? __bpf_prog_run32+0x6b/0x90 [92.682601]? __bpf_prog_run64+0x90/0x90 [92.683636]? lock_downgrade+0x370/0x370 [92.684647]? mark_held_locks+0x44/0x90 [92.685652]? ktime_get+0x117/0x130 [92.686752]? lockdep_hardirqs_on+0x79/0x100 [92.688004]? ktime_get+0x117/0x130 [92.688573]? __cant_migrate+0x2b/0x80 [ 92.689192] ? bpf_test_run+0x2f4/0x510 [92.689869]? bpf_test_timer_continue+0x1c0/0x1c0 [92.690856]? rcu_read_lock_bh_held+0x90/0x90 [92.691506]? __kasan_slab_alloc+0x61/0x80 [92.692128]? eth_type_trans+0x128/0x240 [92.692737]? __build_skb+0x46/0x50 [92.693252]? bpf_prog_test_run_skb+0x65e/0xc50 [92.693954]? bpf_prog_test_run_raw_tp+0x2d0/0x2d0 [92.694639]? __fget_light+0xa1/0x100 [ 92.695162] ? bpf_prog_inc+0x23/0x30 [92.695685]? __sys_bpf+0xb40/0x2c80 [92.696324]? bpf_link_get_from_fd+0x90/0x90 [92.697150]? mark_held_locks+0x24/0x90 [92.698007]? lockdep_hardirqs_on_prepare+0x124/0x220 [92.699045]? finish_task_switch+0xe6/0x370 [92.700072]? lockdep_hardirqs_on+0x79/0x100 [92.701233]? finish_task_switch+0x11d/0x370 [92.702264]? __switch_to+0x2c0/0x740 [ 92.703148] ? mark_held_locks+0x24/0x90 [92.704155]? __x64_sys_bpf+0x45/0x50 [92.705146]? do_syscall_64+0x35/0x80 [92.706953]? Entry_SYSCALL_64_after_hwframe+0x44/0xae [...] Resulta que el rechazo del programa de e411901c0b77 (\"bpf: permitir tailcalls en subprogramas BPF para x64 JIT\") tiene errores ya que env->prog->aux->tail_call_reachable nunca es cierto. La confirmación ebf7d1f508a7 (\"bpf, x64: reelaboración de pro/epílogo y manejo de tailcall en JIT\") agregó un rastreador en check_max_stack_ Depth() que propaga la condición tail_call_reachable a través de los subprogramas. Esta información luego se asigna al ---truncado--- del subprograma."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.10.54","matchCriteriaId":"C9B526EA-4055-43C8-9B30-7E7067C9E43C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.13.6","matchCriteriaId":"512C22FC-1524-4E6F-9E62-4F4B7B6E0576"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*","matchCriteriaId":"71268287-21A8-4488-AA4F-23C473153131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*","matchCriteriaId":"23B9E5C6-FAB5-4A02-9E39-27C8787B0991"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/39f1735c8107ef43a53c4daf82f330d880488d8f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5dd0a6b8582ffbfa88351949d50eccd5b6694ade","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/cbb086074dab631ac43f8645cbac1d7b148e05c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/39f1735c8107ef43a53c4daf82f330d880488d8f","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5dd0a6b8582ffbfa88351949d50eccd5b6694ade","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/cbb086074dab631ac43f8645cbac1d7b148e05c4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]}]}}]}