Linux Kernel BPF Array Bounds Vulnerability

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation has been addressed. The issue arose from the 'may_goto' feature, which improperly added 8 bytes to the stack, leading to an out-of-bounds access in the 'interpreters' array when the index was calculated based on stack size. This vulnerability could be exploited in non-JIT (Just-In-Time) scenarios, where loading BPF programs directly could be rejected, or by calculating 'interpreters[idx]' which might still result in out-of-bounds access, although it would only issue a warning. In JIT-compiled cases, the execution of 'bpf_func' also requires a warning.

Impact

Exploitation of this vulnerability could lead to out-of-bounds array access, potentially causing memory corruption or allowing for arbitrary code execution.