[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 18 Apr 2021 13:16:39 +0100
From: Piotr Krysiuk <piotras@...il.com>
To: oss-security@...ts.openwall.com
Subject: [CVE-2021-29155] Linux kernel protection for sequences of pointer
arithmetic operations against speculatively out-of-bounds loads can be
bypassed to leak content of kernel memory
An issue has been discovered in the Linux kernel mechanism to mitigate
speculatively out-of-bounds loads (Spectre mitigation).
Unprivileged BPF programs running on affected systems can bypass
the protection and execute speculatively out-of-bounds loads from
the kernel memory. This can be abused to extract contents of kernel
memory via side-channel.
The identified gap is that when protecting sequences of pointer
arithmetic operations against speculatively out-of-bounds loads,
the pointer modification performed by the first operation is not
correctly accounted for when restricting subsequent operations.
I developed a PoC that allows unprivileged local users to extract
contents of 31 KByte window within the kernel memory.
The PoC has been shared privately with <security@...nel.org> to
assist with fix development.
The patches are available from Linux kernel mainline public git
repository.
The upstream fix depends on refactoring of the BPF verifier logic.
The full patch series is as follows:
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=9601148392520e2e134936e76788fc2a6371e7be
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=6f55b2f2a1178856c19bbce2f71449926e731914
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=24c109bb1537c12c02aeed2d51a347b4d6a9b76e
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=b658bbb844e28f1862867f37e8ca11a8e2aa94a3
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=a6aaece00a57fa6f22575364b3903dfbccf5345d
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=073815b756c51ba9d8384d924c5d1c03ca3d1ae4
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=f528819334881fd622fdadeddb3f7edaed8b7c9b
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=7fedb63a8307dda0ec3b8969a3b233a1dd7ea8e0
# Discoverers
Piotr Krysiuk <piotras@...il.com>
Benedict Schlueter (independent report)
# References
CVE-2021-29155 (reserved via https://cveform.mitre.org/)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
