[CWE-682] id cleared without delta

[surinderunitone]

Security Fix

Issue: bpf_issue_019
CWE: CWE-682
Match Type: PARTIAL
Affected File: kernel/bpf/verifier.c

Vulnerability Description

Security Advisory

Vulnerability: id cleared without delta

CWE: CWE-682

Affected Files: kernel/bpf/verifier.c

Description:
id cleared without delta

When a non-{add,sub} alu op such as xor is performed on a scalar
register that previously had a BPF_ADD_CONST delta, the else path
in adjust_reg_min_max_vals() only clears dst_reg->id but leaves
dst_reg->delta unchanged.

This stale delta can propagate via assign_scalar_id_before_mov()
when the register is later used in a mov. It gets a fresh id but
keeps the stale delta from the old (now-cleared) BPF_ADD_CONST.
This stale delta can later propagate leading to a verifier-vs-
runtime value mismatch.

The clear_id label already correctly clears both delta and id.
Make the else path consistent by also zeroing the delta when id
is cleared. More generally, this introduces a helper clear_scalar_id()
which internally takes care of zeroing. There are various other
locations in the verifier where only the id is cleared. By usin

Fix Details

• Vulnerable Commit: d7f14173c0d5
• Reference Fix: 1b327732c846
• Generated Fix Match: PARTIAL

---

Generated by Intent Security Fixer