In the Linux kernel, the following vulnerability has been resolved:
bpf: Explicitly check accesses to bpfsockaddr
Syzkaller found a kernel warning on the following sock_addr program:
0: r0 = 0
1: r2 = *(u32 *)(r1 +60)
2: exit
which triggers:
verifier bug: error during ctx access conversion (0)
This is happening because offset 60 in bpfsockaddr corresponds to an implicit padding of 4 bytes, right after msgsrcip4. Access to this padding isn't rejected in sockaddrisvalidaccess and it thus later fails to convert the access.
This patch fixes it by explicitly checking the various fields of bpfsockaddr in sockaddrisvalidaccess.
I checked the other ctx structures and isvalidaccess functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
[
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fabca2fc94d33cdf7ec102058983b086293395f",
"digest": {
"line_hashes": [
"237512326879238009354270839513358809773",
"86454905098829088704174171070264210517",
"226931892962247354499060004319007320663",
"171085825753723637347724875556100641568",
"314219536835273129179577585997942723066",
"104897261410152873974206297333146317365",
"121211079487999105213141026584194645935",
"328288099310947053755468995729055532932",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-40078-1ec136d8"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de44cdc50d2dce8718cb57deddf9cf1be9a7759f",
"digest": {
"line_hashes": [
"237512326879238009354270839513358809773",
"86454905098829088704174171070264210517",
"226931892962247354499060004319007320663",
"171085825753723637347724875556100641568",
"314219536835273129179577585997942723066",
"104897261410152873974206297333146317365",
"121211079487999105213141026584194645935",
"328288099310947053755468995729055532932",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-40078-2f792d9b"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "sock_addr_is_valid_access",
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d8b1a21fd5c34622b0c3893c61e4a38d8ba53ec",
"digest": {
"function_hash": "107488386108572654797498413321717956458",
"length": 2363.0
},
"signature_type": "Function",
"id": "CVE-2025-40078-2ff8a469"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "sock_addr_is_valid_access",
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de44cdc50d2dce8718cb57deddf9cf1be9a7759f",
"digest": {
"function_hash": "198831850760736731729783971815718676114",
"length": 2262.0
},
"signature_type": "Function",
"id": "CVE-2025-40078-3169dcdb"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "sock_addr_is_valid_access",
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad8b4fe5617e3c85fc23267f02500c4f3bf0ff69",
"digest": {
"function_hash": "333151521800159498166728046729788703031",
"length": 2372.0
},
"signature_type": "Function",
"id": "CVE-2025-40078-32e20187"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "sock_addr_is_valid_access",
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdeafacb4f9ff261a96baef519e29480fd7b1019",
"digest": {
"function_hash": "107488386108572654797498413321717956458",
"length": 2363.0
},
"signature_type": "Function",
"id": "CVE-2025-40078-35d2fc8e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d8b1a21fd5c34622b0c3893c61e4a38d8ba53ec",
"digest": {
"line_hashes": [
"237512326879238009354270839513358809773",
"86454905098829088704174171070264210517",
"226931892962247354499060004319007320663",
"171085825753723637347724875556100641568",
"314219536835273129179577585997942723066",
"104897261410152873974206297333146317365",
"121211079487999105213141026584194645935",
"328288099310947053755468995729055532932",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-40078-38a4c998"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe9d33f0470350558cb08cecb54cf2267b3a45d2",
"digest": {
"line_hashes": [
"237512326879238009354270839513358809773",
"86454905098829088704174171070264210517",
"226931892962247354499060004319007320663",
"171085825753723637347724875556100641568",
"314219536835273129179577585997942723066",
"104897261410152873974206297333146317365",
"121211079487999105213141026584194645935",
"328288099310947053755468995729055532932",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-40078-52ff6774"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "sock_addr_is_valid_access",
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fabca2fc94d33cdf7ec102058983b086293395f",
"digest": {
"function_hash": "333151521800159498166728046729788703031",
"length": 2372.0
},
"signature_type": "Function",
"id": "CVE-2025-40078-62360cd4"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "sock_addr_is_valid_access",
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f00858cd9bbbdf67159e28b85a8ca9e77c83622",
"digest": {
"function_hash": "107488386108572654797498413321717956458",
"length": 2363.0
},
"signature_type": "Function",
"id": "CVE-2025-40078-647367b5"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdeafacb4f9ff261a96baef519e29480fd7b1019",
"digest": {
"line_hashes": [
"237512326879238009354270839513358809773",
"86454905098829088704174171070264210517",
"226931892962247354499060004319007320663",
"171085825753723637347724875556100641568",
"314219536835273129179577585997942723066",
"104897261410152873974206297333146317365",
"121211079487999105213141026584194645935",
"328288099310947053755468995729055532932",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-40078-6feee383"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad8b4fe5617e3c85fc23267f02500c4f3bf0ff69",
"digest": {
"line_hashes": [
"237512326879238009354270839513358809773",
"86454905098829088704174171070264210517",
"226931892962247354499060004319007320663",
"171085825753723637347724875556100641568",
"314219536835273129179577585997942723066",
"104897261410152873974206297333146317365",
"121211079487999105213141026584194645935",
"328288099310947053755468995729055532932",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-40078-862d57b3"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "sock_addr_is_valid_access",
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76e04bbb4296fb6eac084dbfc27e02ccc744db3e",
"digest": {
"function_hash": "107488386108572654797498413321717956458",
"length": 2363.0
},
"signature_type": "Function",
"id": "CVE-2025-40078-aaf28459"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "sock_addr_is_valid_access",
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe9d33f0470350558cb08cecb54cf2267b3a45d2",
"digest": {
"function_hash": "107488386108572654797498413321717956458",
"length": 2363.0
},
"signature_type": "Function",
"id": "CVE-2025-40078-af55326d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76e04bbb4296fb6eac084dbfc27e02ccc744db3e",
"digest": {
"line_hashes": [
"237512326879238009354270839513358809773",
"86454905098829088704174171070264210517",
"226931892962247354499060004319007320663",
"171085825753723637347724875556100641568",
"314219536835273129179577585997942723066",
"104897261410152873974206297333146317365",
"121211079487999105213141026584194645935",
"328288099310947053755468995729055532932",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-40078-c28aa4a1"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/core/filter.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f00858cd9bbbdf67159e28b85a8ca9e77c83622",
"digest": {
"line_hashes": [
"237512326879238009354270839513358809773",
"86454905098829088704174171070264210517",
"226931892962247354499060004319007320663",
"171085825753723637347724875556100641568",
"314219536835273129179577585997942723066",
"104897261410152873974206297333146317365",
"121211079487999105213141026584194645935",
"328288099310947053755468995729055532932",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-40078-cac70261"
}
]