Description: eBPF bitwise ops ALU32 bounds tracking References: https://www.openwall.com/lists/oss-security/2021/05/11/11 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e https://github.com/chompie1337/Linux_LPE_eBPF_CVE-2021-3490 Notes: carnil> Introduced by 3f50f132d840 ("bpf: Verifier, do explicit ALU32 carnil> bounds tracking") in 5.7-rc1 respectively the XOR version carnil> introduced in 2921c90d4718 ("bpf: Fix a verifier failure with carnil> xor") in 5.10-rc1. Bugs: upstream: released (5.13-rc4) [049c4e13714ecbca567b4d5f6d563f05d431c80e] 5.10-upstream-stable: released (5.10.37) [282bfc8848eaa195d5e994bb700f2c7afb7eb3e6] 4.19-upstream-stable: N/A "Vulnerable code introduced later" 4.9-upstream-stable: N/A "Vulnerable code introduced later" sid: released (5.10.38-1) 4.19-buster-security: N/A "Vulnerable code introduced later" 4.9-stretch-security: N/A "Vulnerable code introduced later"