CVE-2017-16995

CVE-2017-16995 Registro de mi exploración de la vulnerabilidad CVE-2017-16995 y análisis relacionados Espero poder encontrar uno por mí mismo, jaja Resumen Esta vulnerabilidad es una LPE causada por un error en el juicio de ramas del verificador durante la ejecución virtual de bpf En esencia, es...

CVE-2021-29155

这是 CVE-2021-29155 的漏洞验证（PoC）代码。 投机执行域中指针运算的范围跟踪系统存在不足。 攻击者可以通过侧信道提取内核数据。 这是一个概念验证，你可以从我们的映射（map）最后一个元素起越界读取最多 0x5fff 字节的数据。 此问题已在 5.12 中修复 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=7fedb63a8307dda0ec3b8969a3b233a1dd7ea8e0 ，并向后移植到多个 LTS 内核。...

CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: 从 BPF 验证器中的一个字节到容器逃逸 我在 Linux BPF 验证器中找到一个健全性漏洞——pushstack 调用中的 + 1 导致验证器在分叉路径上跳过一条 ALU 指令。对于 BPFOR，这意味着验证器跟踪 dst = 0，而 CPU 实际计算 0 | K = K。我编写了一个完整的容器逃逸利用：从 BPF map 进行越界（OOB）读写、劫持 vtable、覆盖 modprobepath，最终在宿主机上获得 root 权限。随后我提交了一个包含两个补丁的补丁系列——一个单字符的验证器修复和 90 行 selftests——并将其合并到主线内核...

CVE-2020-8835

CVE-2020-8835 In the Linux kernel 5.5.0 and newer, the bpf verifier kernel/bpf/verifier.c does not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This vulnerability also affects the Linux 5.4 stable series, starting with...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1787291758)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1787291758 advisory. - The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known ...

CVE-2026-93125

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This vulnerability occurs because the verifier does not correctly handle certain buffer size arguments, allowing values larger than a 32-bit integer. When these oversized values are processed, they are truncated, leading ...

CVE-2026-98060

A flaw was found in the Linux kernel. A local user with permissions to load Berkeley Packet Filter BPF programs can cause a Denial of Service DoS or potentially achieve privilege escalation. The BPF verifier fails to prevent resilient lock operations within red-black tree comparison callbacks,...

CVE-2026-98048

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This vulnerability may allow a local user to achieve privilege escalation or cause a Denial of Service DoS through memory corruption. During helper call optimizations, the verifier improperly rewrites instruction sequence...

CVE-2026-98047

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier, which may allow a local attacker to cause a denial of service DoS or potentially escalate privileges. When verifying red-black tree rbtree callbacks, the verifier fails to enforce callback restrictions across nested...

CVE-2026-98044

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This issue allows a privileged local user to cause a Denial of Service DoS or unexpected program rejection by loading a specially crafted BPF program containing legacy packet-load instructions inside callback functions. D...

CVE-2026-98043

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier incorrectly assumes that certain pointer types are non-null without accounting for unbounded offsets that can wrap around to zero at runtime. A local user with permissions to load BPF programs can exploit thi...

CVE-2026-98042

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local user with permissions to load BPF programs could exploit this vulnerability to achieve privilege escalation or cause a denial of service DoS. The issue stems from improper handling of register states during...

CVE-2026-98041

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier incorrectly predicts that 32-bit conditional branch comparisons between a pointer and zero are always taken, failing to account for valid pointer values whose lower 32 bits can be zero. A local attacker could...

CVE-2026-98039

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. The verifier improperly validates pointer types when storing values into per-CPU map fields, allowing standard memory allocations or kernel pointers to be accepted as per-CPU data. A local user with permissions to load BP...

CVE-2026-98037

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. An improper validation check fails to reject untrusted allocated-object pointers after their protection scope expires, incorrectly recognizing them as valid live objects. A local user with permissions to load BPF programs...

CVE-2026-98019

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier failed to mark scalar registers as precise when checking null function arguments and specific helper call parameters, causing its state-tracking logic to improperly prune verification paths. A local attacker...

CVE-2017-16995

CVE-2017-16995 CVE 编号： CVE-2017-16995 发布日期： 2017-12-27T17:08:17.670 基础得分（CVSS 3.0/3.1）： 7.8 描述： Linux 内核至 4.4 版本中的 kernel/bpf/verifier.c 文件的 checkaluop 函数，允许本地用户通过利用不正确的符号扩展来造成拒绝服务（内存损坏），或可能产生其他未指明的影响。...

CVE-2026-98151

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. A local user can trigger a Denial of Service DoS or kernel verification failure by loading a specially crafted BPF program containing speculative pointer arithmetic. This issue occurs because register subregister bounds a...

CVE-2026-98134

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. During pointer register comparisons, the verifier can incorrectly deduce that a pointer cannot be null when it can actually be null at runtime. A local user with permissions to load BPF programs could exploit this flaw by...

CVE-2026-98132

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local attacker with permission to load BPF programs could exploit this flaw to achieve privilege escalation or cause a Denial of Service DoS. This issue arises when the verifier improperly handles scalar values stored o...