A vulnerability has been identified in the eBPF subsystem, which allows running handlers within the Linux kernel in a special JIT-enabled virtual machine (CVE-2021-4204). This vulnerability enables a local unprivileged user to escalate privileges and execute their code at the Linux kernel level. The issue manifests starting with Linux kernel version 5.8 and remains unpatched (affecting release 5.16 as well). Updates addressing this issue in distributions can be tracked on the following pages: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. A working exploit has been reported to be created, with plans for publication on January 18 (users and developers have been given a week to mitigate the vulnerability).
The vulnerability is caused by an improper check of the eBPF programs being executed. The eBPF subsystem provides helper functions, the correctness of which is verified by a dedicated verifier. Some functions require the passing of a PTR_TO_MEM value as an argument, and to prevent potential buffer overflows, the verifier must know the size of the associated memory with the argument. For the functions bpf_ringbuf_submit and bpf_ringbuf_discard, the size information of the passed memory was not communicated to the verifier, which could lead to overwriting memory areas outside the buffer during the execution of specially crafted eBPF code.
To conduct an attack, the user must be able to load their BPF program, and many recent Linux distributions block this capability by default (including unprivileged access to eBPF, which is now prohibited in the kernel itself starting from release 5.16). For example, the vulnerability can be exploited in the default configuration on Ubuntu 20.04 LTS, but in environments like Ubuntu 22.04-dev, Debian 11, openSUSE 15.3, RHEL 8.5, SUSE 15-SP4, and Fedora 33, it only manifests if the administrator sets the kernel.unprivileged_bpf_disabled parameter to 0. As a workaround to block the vulnerability, the execution of BPF programs by unprivileged users can be prohibited with the command "sysctl -w kernel.unprivileged_bpf_disabled=1".
Source: opennet.ru
