oss-security - [CVE-2021-38300] Linux kernel cBPF JIT compiler for MIPS emits incorrect branches leading to execution of arbitrary Kernel code

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAFzhf4oRPW_Qncavep6+Rm24eEuvahatZyWxRQwoKUn_8x65mg@mail.gmail.com>
Date: Wed, 15 Sep 2021 18:47:16 +0100
From: Piotr Krysiuk <piotras@...il.com>
To: oss-security@...ts.openwall.com
Subject: [CVE-2021-38300] Linux kernel cBPF JIT compiler for MIPS emits
 incorrect branches leading to execution of arbitrary Kernel code

An issue has been discovered in the Linux kernel that can be abused by
unprivileged local users to escalate privileges.

The issue is with how the cBPF JIT compiler for MIPS generates branch
instructions. The conditional branch instructions on MIPS use 18-bit
signed offsets allowing for a branch range of 128 KBytes (backward and
forward). However, this limit is not observed by the cBPF JIT compiler,
and so the JIT compiler emits out-of-range branches when translating
certain cBPF programs. This can be abused to craft anomalous machine
code, where the control flow is hijacked to execute arbitrary Kernel
code. Such machine code may be crafted and executed by unprivileged
local users.

I developed a PoC that demonstrates code execution in Kernel mode by
unprivileged local users via setsockopt().

Note that the recently introduced BPF_UNPRIV_DEFAULT_OFF is not
effective against issues in cBPF, including this one.

The issue has been reported to security@...nel.org and included two
alternative patch proposals. The kernel maintainers picked one of the
proposed patches and suggested to send it to the BPF subsystem public
mailing list, before it can be merged into the BPF subsystem public git
repository.

The patch is currently available from:
* https://lore.kernel.org/bpf/20210915160437.4080-1-piotras@gmail.com/

# Discoverer

Piotr Krysiuk <piotras@...il.com>

# References

CVE-2021-38300 (reserved via https://cveform.mitre.org/)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.