A vulnerability (CVE-2021-29154) has been identified in the eBPF subsystem, which allows handlers for tracing, analyzing subsystem performance, and traffic management to run inside the Linux kernel in a special virtual machine with JIT. This vulnerability enables a local user to execute their code at the kernel level. The issue is present up to and including version 5.11.12 and has not yet been fixed in distributions (Debian, Ubuntu, RHEL, Fedora, SUSE, Arch). A patch is available.
According to the researchers who identified the vulnerability, they have developed a working exploit prototype for both 32-bit and 64-bit x86 systems that can be used by an unprivileged user. Red Hat notes that the danger of the problem depends on the availability of the eBPF system call to the user. For example, in RHEL and most other Linux distributions, in the default configuration, the vulnerability can be exploited when BPF JIT is enabled and the user has CAP_SYS_ADMIN rights. As a workaround for protection, it is recommended to disable BPF JIT using the command: echo 0 > /proc/sys/net/core/bpf_jit_enable
The problem is caused by a miscalculation of the offset for branching commands during the generation of machine code by the JIT compiler. Specifically, the generation of branching instructions does not take into account that the offset may change after the optimization stage. This flaw can be exploited to generate anomalous machine code and execute it at the kernel level.
Notably, this is not the only vulnerability in the eBPF subsystem in recent times. At the end of March, two more vulnerabilities (CVE-2020-27170, CVE-2020-27171) were discovered in the kernel, allowing the use of eBPF to bypass protections against Spectre-class vulnerabilities, enabling the identification of kernel memory content by creating conditions for speculative execution of certain operations. A Spectre attack requires a specific sequence of commands in privileged code that leads to speculative execution of instructions. Multiple methods of generating such instructions through manipulation of the BPF programs to be executed have been found in eBPF.
The CVE-2020-27170 vulnerability is caused by the presence of pointer manipulation in the BPF verifier, leading to speculative operations accessing memory outside buffer boundaries. The CVE-2020-27171 vulnerability is related to an integer arithmetic error (integer underflow) when working with pointers, resulting in speculative access to data outside the buffer. These issues have already been fixed in kernel releases 5.11.8, 5.10.25, 5.4.107, 4.19.182, and 4.14.227, and have been included in most Linux distribution kernel updates. Researchers have prepared an exploit prototype that allows an unprivileged user to extract data from kernel memory.
Source: opennet.ru
