{"id":102952,"date":"2022-01-12T21:36:50","date_gmt":"2022-01-12T19:36:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d0%bf%d0%be%d0%b4%d1%81%d0%b8%d1%81%d1%82%d0%b5%d0%bc%d0%b5-ebpf-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0"},"modified":"2022-01-12T21:36:50","modified_gmt":"2022-01-12T19:36:50","slug":"%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d0%bf%d0%be%d0%b4%d1%81%d0%b8%d1%81%d1%82%d0%b5%d0%bc%d0%b5-ebpf-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d0%bf%d0%be%d0%b4%d1%81%d0%b8%d1%81%d1%82%d0%b5%d0%bc%d0%b5-ebpf-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0","title":{"rendered":"A vulnerability in the eBPF subsystem that allows code execution at the Linux kernel level.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the eBPF subsystem, which allows running handlers within the Linux kernel in a special JIT-enabled virtual machine (CVE-2021-4204). This vulnerability enables a local unprivileged user to escalate privileges and execute their code at the Linux kernel level. The issue manifests starting with Linux kernel version 5.8 and remains unpatched (affecting release 5.16 as well). Updates addressing this issue in distributions can be tracked on the following pages: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. A working exploit has been reported to be created, with plans for publication on January 18 (users and developers have been given a week to mitigate the vulnerability). <\/p>\n
The vulnerability is caused by an improper check of the eBPF programs being executed. The eBPF subsystem provides helper functions, the correctness of which is verified by a dedicated verifier. Some functions require the passing of a PTR_TO_MEM value as an argument, and to prevent potential buffer overflows, the verifier must know the size of the associated memory with the argument. For the functions bpf_ringbuf_submit and bpf_ringbuf_discard, the size information of the passed memory was not communicated to the verifier, which could lead to overwriting memory areas outside the buffer during the execution of specially crafted eBPF code. <\/p>\n
To carry out an attack, a user must have the ability to load their BPF program, and many recent Linux distributions, by default, block this capability (including the unprivileged access to eBPF, which is now prohibited by default in the kernel starting from release 5.16). For example, the vulnerability can be exploited in the default configuration in Ubuntu 20.04 LTS, but in the environments of Ubuntu 22.04-dev, Debian 11, openSUSE 15.3, RHEL 8.5, SUSE 15-SP4, and Fedora 33, it only manifests if the administrator sets the kernel.unprivileged_bpf_disabled parameter to 0. As a workaround to block the vulnerability, BPF programs can be restricted from executing by unprivileged users with the command 'sysctl -w kernel.unprivileged_bpf_disabled=1'. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"