Linux Kernel ePBF Local Privilege Escalation Vulnerability (CVE-2020-8835)

The Linux kernel was reported with out-of-bounds reads and writes vulnerability due to lack of calculation in register bounds of ePBF code. Using this vulnerability (CVE-2020-8835), a local authenticated user can exploit and expose sensitive information resulting in high data loss.

In ZDI’s Pwn2own competition, Manfred Paul demonstrated the flaw in the bpf verifier for 32-bit operations.

Description

In the affected Linux kernel versions mentioned below, the bpf verifier (kernel/bpf/verifier.c) leads to out-of-bounds reads and writes vulnerability in the kernel memory because of incorrect restrictions on the register bounds for 32-bit operations. Given that this vulnerability is a local privilege escalation only, attackers would need another vulnerability to exploit this. This reduces the criticality of the vulnerability.

This kernel bug was patched in the last week of March, 2020.

For more information, refer to the video in which ZDI has demonstrated this vulnerability.

What is eBPF?

“Extended Berkeley Packet Filters”, or eBPF is a general tracing feature supported in Linux kernel version 3.15 and later. It allows users to run eBPF programs directly in kernel space and can be used to trace certain kernel functionalities. This feature can also be used to filter network packets.

The Berkeley Packet Filter (BPF) was designed for operating systems to analyze network traffic by using certain programs. “In addition, if the driver for the network interface supports promiscuous mode, it allows the interface to be put into that mode so that all packets on the network can be received, even those destined to other hosts.”, suggests Wikipedia.

Affected Products

Linux kernel 5.4
Linux kernel 5.5

Mitigation

Patches for Ubuntu, Fedora and Debian are already available. In RHEL, normal users aren’t allowed to access the bpf syscall by default. However, for Fedora, it is recommended that users disable unprivileged access to the bpf syscall by setting the following sysctl variable:

###########################################################

Fedora

# sysctl -w kernel.unprivileged_bpf_disabled=1

Ubuntu

$ sudo sysctl kernel.unprivileged_bpf_disabled=1

$ echo kernel.unprivileged_bpf_disabled=1 | \ sudo tee /etc/sysctl.d/90-CVE-2020-8835.conf

###########################################################

Detection

Qualys customers can scan their network with QID(s) 351909, 279867, 158323, 279719, 279661 and 197831 to detect vulnerable Microsoft DNS assets. Please continue to follow Qualys Threat Protection for more coverage on latest vulnerabilities.

References and Sources:

Leave a Reply Cancel reply