Information about vulnerability () in the Linux kernel, which was utilized in the competition during the demonstration of hacking Ubuntu. The vulnerability allowed an unprivileged user to gain root rights. A working exploit exists but has not yet been published. The vulnerability is present in the eBPF subsystem, which allows running handlers for tracing, performance analysis of subsystems, and traffic management, executed within the kernel in a special virtual machine with JIT.
The issue is caused by an error in the __reg_bound_offset32() function, used to check 32-bit operations in BPF bytecode. Due to incorrect calculations of register bounds, during the processing of specially crafted BPF applications, conditions arose for reading and writing data outside the allocated buffer in kernel memory. The issue appeared in kernel 5.5 and later, when porting fixes, it was also transferred to kernel 5.4, as well as to , offered in Ubuntu Linux.
To mitigate the vulnerability, it is recommended to the problematic patch or prevent unprivileged users from executing BPF applications by setting sysctl kernel.unprivileged_bpf_disabled to 1. Status of the fix in distributions: , , , und (in kernels the problematic change was not backported).
Quelle: opennet.ru
