A vulnerability has been identified in the Linux kernel (CVE-2021-33624) that allows the eBPF subsystem to bypass protections against Spectre-class vulnerabilities, enabling the determination of memory contents by creating conditions for speculative execution of certain operations. For a Spectre attack, specific command sequences in privileged code are required to trigger speculative execution of instructions. By manipulating the BPF programs passed for execution, it is possible to generate similar instructions in eBPF and leak kernel memory contents and arbitrary areas of physical memory through side channels.
The vulnerability is caused by shortcomings in the verifier used to identify errors and unauthorized activity in BPF programs. The verifier explores possible code execution paths but misses branching options that are semantically invalid according to the instruction set architecture. During the execution of a BPF program, such branching optionsāoverlooked by the verifierācan be incorrectly predicted by the processor and executed speculatively. For instance, when analyzing a 'load' operation, the verifier expects that the instruction uses a register with an address whose value always falls within certain bounds, but an attacker can create conditions under which the processor attempts to speculatively execute an operation with an address that does not satisfy the verification conditions.
The issue manifests starting from kernel release 4.15 and has been mitigated with patches (1, 2, 3, 4). The vulnerability remains unaddressed in distributions (Debian, RHEL, Ubuntu, Fedora, SUSE, Arch).
Additionally, a note regarding the performance impact of mitigations against Spectre-class vulnerabilities can be highlighted. The note summarizes the results of optimizing the rr (Record and Replay) debugger, which was created at Mozilla for debugging hard-to-reproduce bugs in Firefox. Caching system calls used for checking the existence of directories has reduced the execution time of the 'rr sources' operation for a test project from 3 minutes 19 seconds to 36 seconds.
The optimization author decided to check how performance would change after disabling Spectre protection. After booting the system with the parameter "mitigations=off," the execution time for "rr sources" without optimization was 2 minutes and 5 seconds (1.6 times faster), while with optimization it was 33 seconds (9% faster). Interestingly, disabling Spectre protection not only reduced the kernel-level execution time by 1.4 times (from 2m9s to 1m32s), but also halved the user-space execution time (from 1m9s to 0m33s), presumably due to decreased cache efficiency and TLB flushes with Spectre protection enabled.
Source: opennet.ru
