CVE-2023-54145
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings. Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output.
How to fix
- Linux Linux40c88c429a598006f91ad7a2b89856cd50b3a008, 926a175026fed5d534f587ea4ec3ec49265cd3c5, cff36398bd4c7d322d424433db437f3c3391c491 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a2a7d5701052542cd2260e7659b12443e0a74733 ≤ v < 40c88c429a598006f91ad7a2b89856cd50b3a008, a2a7d5701052542cd2260e7659b12443e0a74733 ≤ v < 926a175026fed5d534f587ea4ec3ec49265cd3c5, a2a7d5701052542cd2260e7659b12443e0a74733 ≤ v < cff36398bd4c7d322d424433db437f3c3391c491, 4.15 | 40c88c429a598006f91ad7a2b89856cd50b3a008, 926a175026fed5d534f587ea4ec3ec49265cd3c5, cff36398bd4c7d322d424433db437f3c3391c491 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.