vulnerability details () in the Linux kernel, which was exploited during the demonstration hacking Ubuntu. The vulnerability allowed an unprivileged user to gain root access. A working exploit exists but has not yet been published. The vulnerability is present in the eBPF subsystem, enabling execution of handlers for tracing, functionality analysis of subsystems, and traffic control, executed within the kernel in a special virtual machine with JIT.
The issue is caused by an error in the __reg_bound_offset32() function, used to check 32-bit operations in BPF bytecode. Due to incorrect boundary calculations, conditions arose that allowed reading and writing data outside the allocated buffer in the kernel memory when processing specially crafted BPF applications. The problem appeared in kernel 5.5 and later when backporting fixes was transferred to kernel 5.4, as well as to , provided in Ubuntu Linux.
To block the vulnerability, it is recommended to the problematic patch or disable the execution of BPF applications by unprivileged users by setting sysctl kernel.unprivileged_bpf_disabled to 1. Fix status in distributions: , , , and (the problematic change was not backported to the kernels ).
Source: opennet.ru
