In the Linux kernel, the following vulnerability has been resolved:
bpf: Invalidate RCU pointers after final spin unlock
In a sleepable BPF program, a spin lock can provide the only RCU protection
for a kptr. The final bpf_spin_unlock() ends that protection, but the
verifier leaves the pointer valid. Another CPU can then free the object
before the pointer is used.
A capability-limited runtime PoC triggered a
task_struct use-after-free in __bpf_get_task_stack(). Record whether the program is in an RCU-protected context before releasing
the lock. Invalidate RCU-protected pointers only when the unlock leaves the
final such context.
This preserves valid pointers in non-sleepable programs
and inside an explicit RCU read-side section.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 3
https://git.kernel.org/stable/c/180c7000712db77063b3a26f4c97e7dd9038f449
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7ae71629357d0a6d0bdadb929c7b296d5b7e61c2
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f81972b235f3ebfa40bdce8bcfee3f242fb24065
416baaa9-dc9f-4396-8d5f-8c081fb06d67