Linux Kernel BPF Iterator Uninitialized State Vulnerability

A vulnerability in the Linux kernel's BPF iterator handling has been addressed. The issue arose because the function 'bpf_iter_scx_dsq_new()' did not consistently initialize the iterator, particularly after an error return. This lack of proper initialization could lead to the iterator referencing invalid data. BPF programs might inadvertently call 'next()' and 'destroy()' on these uninitialized iterators, causing 'bpf_iter_scx_dsq_next()' to dereference garbage data. The vulnerability has been fixed by ensuring that 'bpf_iter_scx_dsq_new()' always clears the iterator state, making the 'next()' and 'destroy()' calls harmless.

Impact

Exploitation of this vulnerability could lead to undefined behavior by allowing BPF programs to operate on uninitialized iterator states, potentially causing data corruption or other unintended consequences.