CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target

[P J P <ppandit () redhat com>]

  Hello,

An off-by-one bug is found in the x86_64 cond jump target of the BPF JIT 
filter code. In case a conditional jump is followed by a long jump, 
conditional jump target is one byte past the start of target instruction.

A user/program could use this flaw to crash the kernel resulting in DoS, or 
potentially escalate user privileges on a system to gain root access.

Upstream fix:
-------------
  -> https://git.kernel.org/linus/a03ffcf873fe0f2565386ca8ef832144c42e67fa

Introduced by:
--------------
  -> https://git.kernel.org/linus/0a14842f5a3c0e88a1e59fac5c3025db39721f74


Note: BPF JIT is disabled by default, must be enabled by the admin.

Thank you.
--
Prasad J Pandit / Red Hat Security Response Team