Date: Wed, 15 Sep 2021 18:47:16 +0100 From: Piotr Krysiuk <piotras@...il.com> To: oss-security@...ts.openwall.com Subject: [CVE-2021-38300] Linux kernel cBPF JIT compiler for MIPS emits incorrect branches leading to execution of arbitrary Kernel code An issue has been discovered in the Linux kernel that can be abused by unprivileged local users to escalate privileges. The issue is with how the cBPF JIT compiler for MIPS generates branch instructions. The conditional branch instructions on MIPS use 18-bit signed offsets allowing for a branch range of 128 KBytes (backward and forward). However, this limit is not observed by the cBPF JIT compiler, and so the JIT compiler emits out-of-range branches when translating certain cBPF programs. This can be abused to craft anomalous machine code, where the control flow is hijacked to execute arbitrary Kernel code. Such machine code may be crafted and executed by unprivileged local users. I developed a PoC that demonstrates code execution in Kernel mode by unprivileged local users via setsockopt(). Note that the recently introduced BPF_UNPRIV_DEFAULT_OFF is not effective against issues in cBPF, including this one. The issue has been reported to security@...nel.org and included two alternative patch proposals. The kernel maintainers picked one of the proposed patches and suggested to send it to the BPF subsystem public mailing list, before it can be merged into the BPF subsystem public git repository. The patch is currently available from: * https://firstname.lastname@example.org/ # Discoverer Piotr Krysiuk <piotras@...il.com> # References CVE-2021-38300 (reserved via https://cveform.mitre.org/)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.