CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in how it handles dynamic inner array lookups when using ARRAY_OF_MAPS with the BPF_F_INNER_MAP flag. This flaw can lead to improper nullness checks during key lookups, potentially allowing an attacker to exploit the discrepancy between template and runtime max_entries values, which could result in unauthorized access or data corruption. Organizations utilizing the Linux kernel in environments where BPF is employed should prioritize this issue to mitigate potential security risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Keep dynamic inner array lookups nullable An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its inner map template. A concrete inner array with a different max_entries value can then replace the template. After a successful outer map lookup, the verifier represents the resulting map pointer using the inner map template. Const-key lookup nullness elision consequently uses the template max_entries even though the runtime helper uses the concrete inner map max_entries. Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP, because the template max_entries does not prove that the key is in bounds for the concrete runtime map.