Linux Kernel BPF Sockmap Fragment Offset Vulnerability in Message Push Data Helper

A vulnerability exists in the Linux kernel's BPF sockmap implementation, specifically within the 'bpf_msg_push_data' helper function. This issue arises when data is inserted into the middle of a scatterlist entry, causing the entry to split into left and right fragments. The right fragment's offset is page-local, but the code incorrectly advances it using the message-global insertion point. This misalignment creates an inconsistent layout, particularly for inserts into non-first scatterlist entries. The vulnerability has been addressed by adjusting the right fragment offset to reflect the correct fragment-local delta, ensuring a consistent split layout.

Impact

Exploitation of this vulnerability could lead to an inconsistent scatterlist fragment layout, potentially causing issues in data handling or processing within the BPF sockmap.

Reproduction

The vulnerability can be reproduced by using the 'bpf_msg_push_data' helper to insert data into a scatterlist entry, particularly one that is not the first in the sequence. This will cause the right fragment offset to be incorrectly advanced, creating an inconsistency that can be observed.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.