In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix BPF_F_CPU validation for sparse CPU IDs
BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map
operation flags. bpf_map_check_op_flags() currently compares that ID
with num_possible_cpus(), which is the number of possible CPUs rather
than a bound on CPU IDs.
On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU
mask was 0,2-3. A userspace program using raw bpf() syscalls creates
a BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations
for each CPU by setting BPF_F_CPU and the CPU ID in the flags.
With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is
rejected with -ERANGE. The CPU 1 update then reaches the per-CPU map
access path and triggers:
Unable to handle kernel paging request at virtual address ...
pc : __pi_memcpy_generic+0x5c/0x22c
lr : bpf_percpu_array_update+0x2dc/0x2e8
Call trace:
__pi_memcpy_generic
bpf_map_update_value
map_update_elem
__sys_bpf
Check the CPU ID against nr_cpu_ids and cpu_possible() instead. This
rejects CPU IDs outside the valid range and CPUs absent from the
possible mask, while allowing valid sparse CPU IDs.
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7
AV:L - The out-of-range CPU ID arrives in attr->flags of the local bpf(2) BPF_MAP_UPDATE_ELEM/LOOKUP_ELEM syscall (map_update_elem/map_lookup_elem -> bpf_map_check_op_flags); no network or adjacent protocol carries it.
AC:H - The check only lets through a CPU ID in a hole of the possible-CPU mask (e.g. 0,2-3 on arm64 device-tree systems). That topology comes from firmware/hardware and the attacker can't create it. It also needs a permissive BPF setup, and where the stray per_cpu_ptr() lands (unmapped init memory vs mapped .data) depends on percpu allocator placement.
PR:L - BPF_MAP_TYPE_PERCPU_ARRAY/PERCPU_HASH are in map_create()'s unprivileged list when unprivileged_bpf_disabled=0 or with a delegated BPF token, and map_update_elem/map_lookup_elem check only FMODE_CAN_WRITE/READ on the map fd, not a capability.
UI:N - The attacker creates or opens the per-CPU map and issues the update/lookup with BPF_F_CPU and a hole CPU ID entirely on their own; no other user acts.
S:U - The bad access corrupts or reads kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.
C:H - bpf_percpu_array_copy() copies value_size bytes from per_cpu_ptr(pptr, cpu) for a missing CPU whose __per_cpu_offset is 0, i.e. from a stray kernel address, back to userspace via BPF_MAP_LOOKUP_ELEM, and the attacker can repeat it.
I:H - bpf_percpu_array_update() does copy_map_value() of attacker-supplied value bytes to per_cpu_ptr(pptr, cpu) for the missing CPU. That is an out-of-bounds write of controlled data to an address outside any valid per-CPU unit, which can land in kernel .data past __init_end.
A:H - As the fix commit shows, the update faults in __pi_memcpy_generic from bpf_percpu_array_update on unmapped memory (the freed/vunmapped __init region on arm64), causing a kernel oops.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
High |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The out-of-range CPU ID arrives in attr->flags of the local bpf(2) BPF_MAP_UPDATE_ELEM/LOOKUP_ELEM syscall (map_update_elem/map_lookup_elem -> bpf_map_check_op_flags); no network or adjacent protocol carries it.
AC:H - The check only lets through a CPU ID in a hole of the possible-CPU mask (e.g. 0,2-3 on arm64 device-tree systems). That topology comes from firmware/hardware and the attacker can't create it. It also needs a permissive BPF setup, and where the stray per_cpu_ptr() lands (unmapped init memory vs mapped .data) depends on percpu allocator placement.
PR:L - BPF_MAP_TYPE_PERCPU_ARRAY/PERCPU_HASH are in map_create()'s unprivileged list when unprivileged_bpf_disabled=0 or with a delegated BPF token, and map_update_elem/map_lookup_elem check only FMODE_CAN_WRITE/READ on the map fd, not a capability.
UI:N - The attacker creates or opens the per-CPU map and issues the update/lookup with BPF_F_CPU and a hole CPU ID entirely on their own; no other user acts.
S:U - The bad access corrupts or reads kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.
C:H - bpf_percpu_array_copy() copies value_size bytes from per_cpu_ptr(pptr, cpu) for a missing CPU whose __per_cpu_offset is 0, i.e. from a stray kernel address, back to userspace via BPF_MAP_LOOKUP_ELEM, and the attacker can repeat it.
I:H - bpf_percpu_array_update() does copy_map_value() of attacker-supplied value bytes to per_cpu_ptr(pptr, cpu) for the missing CPU. That is an out-of-bounds write of controlled data to an address outside any valid per-CPU unit, which can land in kernel .data past __init_end.
A:H - As the fix commit shows, the update faults in __pi_memcpy_generic from bpf_percpu_array_update on unmapped memory (the freed/vunmapped __init region on arm64), causing a kernel oops.
CVSS 3.1