Achọpụtala adịghị ike (CVE-2021-4204) na sistemụ eBPF, nke na-enye gị ohere ịme ndị na-ahụ maka ọrụ n'ime kernel Linux n'ime igwe mebere pụrụ iche nwere JIT, na-enye onye ọrụ na-enweghị ohere n'ime mpaghara nweta nkwalite ohere ma mebie koodu ha na ụlọ ọrụ ahụ. Ọkwa kernel Linux. Nsogbu a na-apụta kemgbe Linux kernel 5.8 ma na-edobeghi ya (gụnyere ntọhapụ 5.16). Enwere ike ịchọta ọkwa nke mmelite a na-emepụta iji dozie nsogbu ahụ na nkesa na ibe ndị a: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. Ekwuwapụtala na emepụtara arụrụ arụ ọrụ, nke a na-eme atụmatụ ibipụta na Jenụwarị 18 (enyela ndị ọrụ na ndị mmepe otu izu iji dozie adịghị ike).
A na-ebute adịghị ike ahụ site na nkwenye na-ezighi ezi nke mmemme eBPF ebufere maka mmezu. Usoro nke eBPF na-enye ọrụ inyeaka, nke ejiri nkwenye pụrụ iche kwadoro ojiji ya nke ọma. Ụfọdụ ọrụ chọrọ ịgafe uru PTR_TO_MEM dị ka arụmụka, yana iji gbochie nfebigara ihe nwere ike ime, onye nyocha ga-amarịrị nha ebe nchekwa jikọtara ya na arụmụka ahụ. Maka ọrụ bpf_ringbuf_submit na bpf_ringbuf_discard, a kọghị data gbasara nha ebe nchekwa ebufetara na onye nyocha, nke enwere ike iji degharịa mpaghara ebe nchekwa gafere oke oke mgbe ị na-eme koodu eBPF emebere nke ọma.
Iji mee mwakpo, onye ọrụ ga-enwerịrị ike ibu mmemme BPF nke ya, na ọtụtụ nkesa Linux na-adịbeghị anya na-egbochi ikike a site na ndabara (gụnyere ohere na-enweghị ohere ịnweta eBPF ugbu a ka amachibidoro ndabara na kernel n'onwe ya, malite na ntọhapụ 5.16). Dịka ọmụmaatụ, enwere ike iji nsogbu ahụ mee ihe na nhazi ndabara na Ubuntu 20.04 LTS, mana na gburugburu Ubuntu 22.04-dev, Debian 11, openSUSE 15.3, RHEL 8.5, SUSE 15-SP4 na Fedora 33 ọ na-egosi naanị ma ọ bụrụ na onye nchịkwa edozila. the kernel.unprivileged_bpf_disabled parameter to 0. Dị ka ihe na-arụ ọrụ maka igbochi adịghị ike ahụ, ị nwere ike igbochi mmezu nke mmemme BPF site n'aka ndị ọrụ na-enweghị ihe ọ bụla na iwu "sysctl -w kernel.unprivileged_bpf_disabled=1".
isi: opennet.ru