huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-47739: kernel: padata: use integer wrap around to prevent deadlock on seq_nr overflow
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-21T00:00:00+00:00

A flaw was found in the padata (parallel algorithm data) subsystem in the Linux kernel. An integer overflow can be triggered when processing more than 2^32 (~4GiB) padata objects, causing a deadlock in the serialization process, potentially resulting in a denial of service.


Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.227, 5.15.168, 6.1.113, 6.10.13, 6.11.2, 6.12, 6.6.54
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 46c4079460f4dcaf445860679558eedef4e1bc91
CVE-2024-47745: kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages()
Component: kernel
Severity: Moderate
CWE: CWE-670 (Always-Incorrect Control Flow Implementation)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-10-21T00:00:00+00:00

A flaw was found in the remap_file_pages function in mm/mmap.c in the Linux kernel, where it does not properly restrict execute access. This vulnerability allows local users to bypass intended SELinux W^X policy restrictions.

Statement: This issue affects the Linux kernel shipping with Red Hat Enterprise Linux 8 and 9.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and before.

This flaw breach confidentiality due to bypassing incorrect SELinux policy.

Red Hat has assessed the severity as moderate for the following reasons.

1.First, while the vulnerability allows a bypass of security enforcement (W^X via SELinux), it must be triggered under a narrow sequence: the process must use READ_IMPLIES_EXEC personality and then call remap_file_pages() on RW pages. That is not necessarily common in many workloads.

2. Even if a bypass is possible, it does not necessarily guarantee full root escalation or total system compromise; the benefit depends on what code or memory segments can be manipulated, if at all.

Affected upstream versions: 3.16.59 < 3.17, 4.0
Fixed upstream versions: 0, 3.17, 6.1.120, 6.10.13, 6.11.2, 6.12, 6.6.54
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1
CVE-2024-47748: kernel: vhost_vdpa: assign irq bypass producer token correctly
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-10-21T00:00:00+00:00

A use-after-free flaw was found in drivers/vhost/vdpa.c in the Linux kernel.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.227, 5.15.168, 6.1.113, 6.10.13, 6.11.2, 6.12, 6.6.54
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0c170b1e918b9afac25e2bbd01eaa2bfc0ece8c0
CVE-2024-47762: backstage/plugin-app-backend: Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Component: backstage/plugin-app-backend
Severity: Moderate
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Public date: 2024-10-03T17:14:34.529000+00:00

A flaw was found in the backstage/plugin-app-backend package. Configurations supplied through APP_CONFIG_* environment variables unexpectedly ignore the visibility defined in the configuration schema, potentially exposing sensitive configuration details intended to remain private or restricted to backend processes.


Affected upstream versions: < 0.3.75
Fixed upstream versions: v1.32.0
Upstream repository: https://github.com/backstage/backstage
Upstream fix commit: 323e6129073c5cb4cc106a1239eaec31a129554f
CVE-2024-47855: json-lib: Mishandling of an unbalanced comment string in json-lib
Component: json-lib
Severity: Moderate
CWE: CWE-1286 (Improper Validation of Syntactic Correctness of Input)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-10-04T00:00:00+00:00

A flaw was found in JSON-lib's JSONTokener component. This vulnerability allows a denial of service via an unbalanced comment string.


Affected upstream versions: n/a
Fixed upstream versions: v3.1.0
Upstream repository: https://github.com/kordamp/json-lib
Upstream fix commit: a0c4a0eae277130e22979cf307c95dec4005a78e
CVE-2024-47875: dompurify: nesting-based mutation XSS vulnerability
Component: dompurify
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)
Public date: 2024-10-11T15:15:05.860000+00:00

A flaw was found in DOMPurify that could allow for a nesting-based mXSS to not be properly sanitized.


Affected upstream versions: < 2.5.0, < 3.1.3
Fixed upstream versions: 2.5.1
Upstream repository: https://github.com/cure53/DOMPurify
Upstream fix commit: 0ef5e537a514f904b6aa1d7ad9e749e365d7185f
CVE-2024-48873: kernel: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-01-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: check return value of ieee80211_probereq_get() for RNR

The return value of ieee80211_probereq_get() might be NULL, so check it
before using to avoid NULL pointer access.

Addresses-Coverity-ID: 1529805 ("Dereference null return value")


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1a0f54cb3fea5d087440b2bae03202c445156a8d
CVE-2024-48910: dompurify: DOMPurify vulnerable to tampering by prototype pollution
Component: dompurify
Severity: Important
CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)
Public date: 2024-10-31T14:22:52.867000+00:00

A prototype pollution vulnerability was found in DOMPurify. This flaw allows a remote attacker to add or modify attributes of an object prototype. This issue can lead to the injection of malicious attributes used in other components or cause a crash by overriding existing attributes with ones of incompatible type.

Statement: The prototype pollution vulnerability in DOMPurify is considered a high-severity issue because it allows attackers to modify the prototype of built-in JavaScript objects, potentially impacting the entire application. This could lead to security risks, such as overwriting methods on fundamental objects like `Object`, `Array`, or `Function`, allowing attackers to manipulate application behavior, bypass security controls, or cause application crashes. Given that DOMPurify is a core library for sanitizing user input, an attacker exploiting this vulnerability could gain control over how sanitized content is processed, leading to the execution of malicious scripts or triggering other unintended behaviors across the application.

Affected upstream versions: < 2.4.2
Fixed upstream versions: 2.4.2
Upstream repository: https://github.com/cure53/DOMPurify
Upstream fix commit: d1dd0374caef2b4c56c3bd09fe1988c3479166dc
CVE-2024-48916: ceph: rhceph-container: Authentication bypass in CEPH RadosGW
Component: ceph
Severity: Important
CWE: CWE-345 (Insufficient Verification of Data Authenticity)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2024-12-02T00:00:00+00:00

A vulnerability in the Ceph Rados Gateway (RadosGW) OIDC provider allows attackers to bypass JWT signature verification by supplying a token with "none" as the algorithm (alg). This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid tokens without a signature.

Statement: This vulnerability is rated Important due to its ability to bypass JWT signature verification in Ceph Rados Gateway, allowing attackers to forge tokens and gain unauthorized access.

OpenShift Data Foundation (ODF) is affected but not vulnerable to this issue. To exploit this issue, an attacker needs to use OIDC and manually set the algorithm to "none", then RadosGW will not validate the signature on a JWT. ODF is protected because it uses the Vault API to interface with OIDC (and other providers) and it does not support "none" as an algorithm type.

Affected upstream versions: <= 19.2.3
Fixed upstream versions: v20.0.0
Upstream repository: https://github.com/ceph/ceph
Upstream fix commit: 919da3696668a07c6810dfa39301950c81c2eba4
CVE-2024-48949: elliptic: Missing Validation in Elliptic's EDDSA Signature Verification
Component: elliptic
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
Public date: 2024-10-10T00:00:00+00:00

A flaw was found in the Elliptic package. This vulnerability allows attackers to bypass EDDSA signature validation via improper handling of signature values where the S() component of the signature is not properly checked for being non-negative or smaller than the curve order.

Statement: Thunderbird is not supported in Red Hat Enterprise Linux 7 ELS.

Affected upstream versions: n/a
Fixed upstream versions: v6.5.6
Upstream repository: https://github.com/indutny/elliptic
Upstream fix commit: 7ac5360118f74eb02da73bdf9f24fd0c72ff5281
CVE-2024-49569: kernel: nvme-rdma: unquiesce admin_q before destroy it
Component: kernel
Severity: Moderate
CWE: CWE-460 (Improper Cleanup on Thrown Exception)
CVSS v3: 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-01-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-rdma: unquiesce admin_q before destroy it

Kernel will hang on destroy admin_q while we create ctrl failed, such
as following calltrace:

PID: 23644    TASK: ff2d52b40f439fc0  CPU: 2    COMMAND: "nvme"
 #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15
 #1 [ff61d23de260fc08] schedule at ffffffff8323c014
 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1
 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a
 #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006
 #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce
 #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced
 #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b
 #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362
 #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25
    RIP: 00007fda7891d574  RSP: 00007ffe2ef06958  RFLAGS: 00000202
    RAX: ffffffffffffffda  RBX: 000055e8122a4d90  RCX: 00007fda7891d574
    RDX: 000000000000012b  RSI: 000055e8122a4d90  RDI: 0000000000000004
    RBP: 00007ffe2ef079c0   R8: 000000000000012b   R9: 000055e8122a4d90
    R10: 0000000000000000  R11: 0000000000000202  R12: 0000000000000004
    R13: 000055e8122923c0  R14: 000000000000012b  R15: 00007fda78a54500
    ORIG_RAX: 0000000000000001  CS: 0033  SS: 002b

This due to we have quiesced admi_q before cancel requests, but forgot
to unquiesce before destroy it, as a result we fail to drain the
pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here
try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and
simplify the code.

Statement: The bug could happen only if NVME over RDMA Transport being used. It happens during disconnection and leads to hang of NVME only (that is deny of service). The security impact is limited.

Affected upstream versions: 5.4.103 < 5.5, 5.10.21 < 5.11, 5.11.4 < 5.12, 5.12
Fixed upstream versions: 0, 5.11, 5.12, 5.5, 6.12.5, 6.13, 6.6.88
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 427036030f4d796533dcadba9b845896cb6c10a7
CVE-2024-49570: kernel: drm/xe/tracing: Fix a potential TP_printk UAF
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/tracing: Fix a potential TP_printk UAF

The commit
afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format")
exposes potential UAFs in the xe_bo_move trace event.

Fix those by avoiding dereferencing the
xe_mem_type_to_name[] array at TP_printk time.

Since some code refactoring has taken place, explicit backporting may
be needed for kernels older than 6.10.


Affected upstream versions: 6.11
Fixed upstream versions: 0, 6.12.16, 6.13.4, 6.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 62cd174616ae3bf8a6cf468718f1ae74e5a07727
CVE-2024-49761: rexml: REXML ReDoS vulnerability
Component: rexml
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-28T14:10:23.212000+00:00

A flaw was found in the ReXML XML toolkit for Ruby. Parsing XML data containing a large number of digits between `&# `and `x...;` in a hex numeric character reference (`&#x...;`) can trigger a regular expression denial of service (ReDoS) condition, leading to a denial of service.

Statement: This vulnerability is rated as a moderate severity because it allows attackers to exploit inefficient regex parsing in hex numeric character references (&#x...;), causing a ReDoS and impacting availability, it requires specific malicious input but does not affect confidentiality or integrity.

Satellite employs multiple versions of ReXML in the Puppet Agent and Server components across varying versions of Satellite:

- In Satellite 6.15 (on RHEL8), the Puppet Agent component uses ReXML version 7.28-0-1 and IS affected.

- In Satellite 6.15 (on RHEL8), the Satellite server component uses ReXML version 7.17.2-1 and is NOT affected.

- In Satellite 6.16 and 6.17 (on RHEL8 and RHEL9), the Puppet Agent component uses ReXML version 8.8.1-1 and is NOT affected.

- In Satellite 6.16 and 6.17 (on RHEL8 and RHEL9), the Satellite server component uses ReXML version 8.6.2-2 and IS affected.

To reiterate, only the Puppet Agent component in Satellite 6.15 and the Satellite server component in Satellite 6.16 and 6.17 are affected. Any other component/Satellite version combinations are considered not-affected.

Affected upstream versions: < 3.3.9
Fixed upstream versions: v3.3.9
Upstream repository: https://github.com/ruby/rexml
Upstream fix commit: ce59f2eb1aeb371fe1643414f06618dbe031979f
CVE-2024-49767: werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms
Component: werkzeug
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-10-25T19:41:35.029000+00:00

A flaw was found in the Werkzueg web application library. Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting and trigger a denial of service.


Affected upstream versions: >= 2.0.0rc1, < 3.0.6, < 0.20.0
Fixed upstream versions: 0.19.7
Upstream repository: https://github.com/pallets/quart
Upstream fix commit: 5e78c4169b8eb66b91ead3e62d44721b9e1644ee
CVE-2024-49768: waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request
Component: waitress
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2024-10-29T14:32:25.164000+00:00

A flaw was found in the Waitress WSGI server for Python. A remote client can send a request that is exactly `recv_bytes`, which defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default), Waitress won't read any more requests, and when the first request fails due to a parsing error, it simply closes the connection. 

However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed.


Affected upstream versions: >= 2.0.0, < 3.0.1
Fixed upstream versions: v3.0.1
Upstream repository: https://github.com/Pylons/waitress
Upstream fix commit: e4359018537af376cf24bd13616d861e2fb76f65
CVE-2024-49769: waitress: Waitress has a denial of service leading to high CPU usage/resource exhaustion
Component: waitress
Severity: Important
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-29T14:18:40.951000+00:00

A flaw was found in the Waitress WSGI server for Python. When a remote client closes the connection before waitress has had the opportunity to call `getpeername()`, waitress will incorrectly clean up the connection, leading to the main thread attempting to write to a socket that no longer exists, and that socket is not removed from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could exhaust the available sockets with very little resources required.


Affected upstream versions: < 3.0.1
Fixed upstream versions: v3.0.1
Upstream repository: https://github.com/Pylons/waitress
Upstream fix commit: 1ae4e894c9f76543bee06584001583fc6fa8c95c
CVE-2024-49851: kernel: tpm: Clean up TPM space after command failure
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tpm: Clean up TPM space after command failure

tpm_dev_transmit prepares the TPM space before attempting command
transmission. However if the command fails no rollback of this
preparation is done. This can result in transient handles being leaked
if the device is subsequently closed with no further commands performed.

Fix this by flushing the space in the event of command transmission
failure.


Affected upstream versions: 4.12
Fixed upstream versions: 0, 5.10.227, 5.15.168, 5.4.285, 6.1.113, 6.10.13, 6.11.2, 6.12, 6.6.54
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 87e8134c18977b566f4ec248c8a147244da69402
CVE-2024-49856: kernel: x86/sgx: Fix deadlock in SGX NUMA node search
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/sgx: Fix deadlock in SGX NUMA node search

When the current node doesn't have an EPC section configured by firmware
and all other EPC sections are used up, CPU can get stuck inside the
while loop that looks for an available EPC page from remote nodes
indefinitely, leading to a soft lockup. Note how nid_of_current will
never be equal to nid in that while loop because nid_of_current is not
set in sgx_numa_mask.

Also worth mentioning is that it's perfectly fine for the firmware not
to setup an EPC section on a node. While setting up an EPC section on
each node can enhance performance, it is not a requirement for
functionality.

Rework the loop to start and end on *a* node that has SGX memory. This
avoids the deadlock looking for the current SGX-lacking node to show up
in the loop when it never will.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.168, 6.1.113, 6.10.13, 6.11.2, 6.12, 6.6.54
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 40fb64257dab507d86b5f1f2a62f3669ef0c91a8
CVE-2024-49860: kernel: ACPI: sysfs: validate return type of _STR method
Component: kernel
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ACPI: sysfs: validate return type of _STR method

Only buffer objects are valid return values of _STR.

If something else is returned description_show() will access invalid
memory.


Affected upstream versions: 3.7
Fixed upstream versions: 0, 4.19.323, 5.10.227, 5.15.168, 5.4.285, 6.1.113, 6.10.13, 6.11.2, 6.12, 6.6.54
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 92fd5209fc014405f63a7db79802ca4b01dc0c05
CVE-2024-49861: kernel: bpf: Fix helper writes to read-only maps
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix helper writes to read-only maps

Lonial found an issue that despite user- and BPF-side frozen BPF map
(like in case of .rodata), it was still possible to write into it from
a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT}
as arguments.

In check_func_arg() when the argument is as mentioned, the meta->raw_mode
is never set. Later, check_helper_mem_access(), under the case of
PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the
subsequent call to check_map_access_type() and given the BPF map is
read-only it succeeds.

The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT
when results are written into them as opposed to read out of them. The
latter indicates that it's okay to pass a pointer to uninitialized memory
as the memory is written to anyway.

However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM
just with additional alignment requirement. So it is better to just get
rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the
fixed size memory types. For this, add MEM_ALIGNED to additionally ensure
alignment given these helpers write directly into the args via *<ptr> = val.
The .arg*_size has been initialized reflecting the actual sizeof(*<ptr>).

MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated
argument types, since in !MEM_FIXED_SIZE cases the verifier does not know
the buffer size a priori and therefore cannot blindly write *<ptr> = val.

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 9 to confirm the current state, inspect the sysctl with the command:

    cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

Affected upstream versions: 5.2
Fixed upstream versions: 0, 6.1.120, 6.10.13, 6.11.2, 6.12, 6.6.54
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 988e55abcf7fdb8fc9a76a7cf3f4e939a4d4fb3a