### [CVE-2024-53125](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53125)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=5.10%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=75748837b7e56919679e02163f45d5818c644d03%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

In the Linux kernel, the following vulnerability has been resolved:bpf: sync_linked_regs() must preserve subreg_defRange propagation must not affect subreg_def marks, otherwise thefollowing example is rewritten by verifier incorrectly whenBPF_F_TEST_RND_HI32 flag is set:  0: call bpf_ktime_get_ns                   call bpf_ktime_get_ns  1: r0 &= 0x7fffffff       after verifier   r0 &= 0x7fffffff  2: w1 = w0                rewrites         w1 = w0  3: if w0 < 10 goto +0     -------------->  r11 = 0x2f5674a6     (r)  4: r1 >>= 32                               r11 <<= 32           (r)  5: r0 = r1                                 r1 |= r11            (r)  6: exit;                                   if w0 < 0xa goto pc+0                                             r1 >>= 32                                             r0 = r1                                             exit(or zero extension of w1 at (2) is missing for architectures that require zero extension for upper register half).The following happens w/o this patch:- r0 is marked as not a subreg at (0);- w1 is marked as subreg at (2);- w1 subreg_def is overridden at (3) by copy_register_state();- w1 is read at (5) but mark_insn_zext() does not mark (2)  for zero extension, because w1 subreg_def is not set;- because of BPF_F_TEST_RND_HI32 flag verifier inserts random  value for hi32 bits of (2) (marked (r));- this random value is read at (5).

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/oogasawa/Utility-security
- https://github.com/w4zu/Debian_security