Linux kernel (eBPF verifier): eBPF ALU32 bitwise-op bounds tracking flaw

Impact

eBPF ALU32 bitwise-op bounds tracking flaw - arbitrary kernel read/write from unprivileged BPF

Who can reach it

Any tenant process in a container where unprivileged BPF is enabled

What to do

Livepatchable; otherwise drain + reboot. Durable control: kernel.unprivileged_bpf_disabled=1 fleet-wide

References

Related entries

• Linux kernel (eBPF verifier): kernel/bpf/verifier.c mishandles pointer types - unprivileged BPF to local rootCVE-2022-23222 · Linux kernel (eBPF verifier)Medium
• Linux kernel (eBPF verifier): Incorrect verifier pruning marks unsafe paths as safeCVE-2023-2163 · Linux kernel (eBPF verifier)High
• polkit: Local privilege escalation via polkit_system_bus_name_get_creds_sync() raceCVE-2021-3560 · polkitHigh
• polkit (pkexec): PwnKit: local privilege escalation to root via argv handlingCVE-2021-4034 · polkit (pkexec)High
• Linux kernel (net/smc): The CDC send-completion handler takes a lock inside an smc_sock that close() has already freedCVE-2021-46925 · Linux kernel (net/smc)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amd/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2021-47551 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amd/amdkfd)High