oss-sec mailing list archives
[CVE-2021-29155] Linux kernel protection for sequences of pointer arithmetic operations against speculatively out-of-bounds loads can be bypassed to leak content of kernel memory
From: Piotr Krysiuk <piotras () gmail com>
Date: Sun, 18 Apr 2021 13:16:39 +0100
An issue has been discovered in the Linux kernel mechanism to mitigate speculatively out-of-bounds loads (Spectre mitigation). Unprivileged BPF programs running on affected systems can bypass the protection and execute speculatively out-of-bounds loads from the kernel memory. This can be abused to extract contents of kernel memory via side-channel. The identified gap is that when protecting sequences of pointer arithmetic operations against speculatively out-of-bounds loads, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations. I developed a PoC that allows unprivileged local users to extract contents of 31 KByte window within the kernel memory. The PoC has been shared privately with <security () kernel org> to assist with fix development. The patches are available from Linux kernel mainline public git repository. The upstream fix depends on refactoring of the BPF verifier logic. The full patch series is as follows: * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=9601148392520e2e134936e76788fc2a6371e7be * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=6f55b2f2a1178856c19bbce2f71449926e731914 * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=24c109bb1537c12c02aeed2d51a347b4d6a9b76e * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=b658bbb844e28f1862867f37e8ca11a8e2aa94a3 * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=a6aaece00a57fa6f22575364b3903dfbccf5345d * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=073815b756c51ba9d8384d924c5d1c03ca3d1ae4 * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=f528819334881fd622fdadeddb3f7edaed8b7c9b * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=7fedb63a8307dda0ec3b8969a3b233a1dd7ea8e0 # Discoverers Piotr Krysiuk <piotras () gmail com> Benedict Schlueter (independent report) # References CVE-2021-29155 (reserved via https://cveform.mitre.org/)
Current thread:
- [CVE-2021-29155] Linux kernel protection for sequences of pointer arithmetic operations against speculatively out-of-bounds loads can be bypassed to leak content of kernel memory Piotr Krysiuk (Apr 18)