Privilege escalation via eBPF in Linux 4.9 and beyond

Jann Horn has reported eight bugs in theeBPF verifier, one for the 4.9 kernel and seven introduced in 4.14, to theoss-security mailing list. Someof these bugs result in eBPF programs being able to read and write arbitrarykernel memory, thus can be used for a variety of ill effects, includingprivilege escalation. As Ben Hutchings notes,one mitigation would be to disable unprivileged access to BPF using thefollowing sysctl:kernel.unprivileged_bpf_disabled=1. More information can also be foundin this ProjectZero bug entry. The fixes are not yet in the mainline tree, but are inthe netdev tree. Hutchings goes on to say: "There is a publicexploit that uses several of these bugs to get root privileges. It doesn'twork as-is on stretch [Debian 9] with the Linux 4.9 kernel, but is easy to adapt. Irecommend applying the above mitigation as soon as possible to all systemsrunning Linux 4.4 or later."