Linux kernel eBPF: syncookie helpers read sk_protocol on mini-sockets without a fullsock check

Impact

Both helpers accept a socket pointer typed ARG_PTR_TO_BTF_ID_SOCK_COMMON and then dereference sk->sk_protocol, a field that only exists on full sockets. Handing them a request or time-wait mini-socket reads outside the allocated object. NVD scores it local with confidentiality and integrity impact, which fits an out-of-bounds read of kernel memory reachable from an attacker-shaped BPF program. On a GPU node the exposure is the host network stack and whatever privileged components load BPF there, typically the CNI and eBPF-based observability agents, rather than an ordinary tenant pod. The fix short-circuits on sk_state != TCP_LISTEN, since mini-sockets are never in TCP_LISTEN.

Who can reach it

Local, and it requires the privilege to load eBPF programs that call these helpers: CAP_BPF plus CAP_NET_ADMIN, or root. A tenant confined to an unprivileged GPU pod cannot reach it; a container granted BPF capability for networking or tracing can, as can any local user with root on the node.

What to do

Take the stable-tree fix (linked commits) via a distribution kernel update and boot into it. There is no runtime switch, so this is a rolling drain and reboot across the fleet, which on GPU nodes means evicting long-running training jobs. Until the reboot, the mitigation is to keep CAP_BPF and CAP_NET_ADMIN off tenant workloads and limit BPF loading to the platform agents you ship.

References

Related entries

• Xen on AMD - x86 HVM pagetable height update: AMD HVM guest OS users can trigger a data-structure access during aCVE-2019-19577 · Xen on AMD - x86 HVM pagetable height updateHigh
• IBM Spectrum Scale kernel module: An unauthenticated local trigger takes down the Spectrum Scale kernel module and withCVE-2020-4411 · IBM Spectrum Scale kernel moduleHigh
• Xen - x86 IOMMU command timeout detection and handling: Xen's IOMMU command timeout handling is inappropriate, so IOMMUCVE-2021-28692 · Xen - x86 IOMMU command timeout detection and handlingHigh
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2021-4460 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Xen (x86): Unintended memory sharing between guests - cross-tenant data exposureCVE-2022-42327 · Xen (x86)High
• Linux kernel (arch/x86/kvm): A guest that is not advertised long mode makes the host's SMM emulator walk 16CVE-2022-49883 · Linux kernel (arch/x86/kvm)High