Linux Kernel sg.copy Synchronization Vulnerability in sk_msg Transform Paths

A vulnerability exists in the Linux kernel's handling of the sk_msg scatterlist copy bitmap, which is crucial for managing entry ownership. The issue arises because certain sk_msg transformation processes can inadvertently clear the copy bit for entries backed by external pages, such as those from the file cache. This mismanagement can lead to exposure of these entries through writable BPF context data, allowing BPF stores to modify the original page cache. The vulnerability affects the Linux kernel stable tree and has been addressed by ensuring that the sg.copy state is properly synchronized with the sg.data entries during transformations, particularly in BPF-related operations and TLS record handling.

Impact

The vulnerability could allow BPF stores to write to the original page cache, potentially modifying file data or disrupting application behavior that relies on the integrity of the page cache.

Reproduction

The vulnerability can be reproduced by creating a BPF program that interacts with sk_msg data, such as through the BPF push, pull, or pop helpers. This program can be attached to a socket that uses TLS, which will trigger the vulnerable TLS record splitting process. During this interaction, the sk_msg transform paths will move or copy scatterlist entries without properly updating the corresponding sg.copy bitmap. As a result, an entry backed by external file cache pages can be exposed as writable BPF context data, allowing for modification of the original page cache.

Remediation

Users should update to the latest version of the Linux kernel stable tree, where this vulnerability has been fixed.