An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking 32-bit instructions in an eBPF program occurs. This flaw allows an unprivileged user or process to execute eBPF programs to crash the kernel, resulting in a denial of service or potentially gaining root privileges on the system.
An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking 32-bit instructions in an eBPF program occurs. This flaw allows an unprivileged user or process to execute eBPF programs to crash the kernel, resulting in a denial of service or potentially gaining root privileges on the system.
https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T/ https://www.openwall.com/lists/oss-security/2020/03/30/3
Vulmon
Workaround:
# sysctl -w kernel.unprivileged_bpf_disabled=1
Introduced by:
581738a681b6 ("bpf: Provide better register bounds after jmp32 instructions")
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=581738a681b6faae5725c2555439189ca81c0f1f