CVE-2017-16995

CVE-2017-16995 CVE-2017-16995の脆弱性と関連分析を自分で試行錯誤した記録 （自分で見つけられればいいな、笑） 概要 この脆弱性は、bpf仮想実行時に検証器の分岐判断ミスによって引き起こされるLPEです 原理的には整数拡張の脆弱性です 分析 トリガー https://ph4ntonn.github.io/CVE-2017-16995-trigger.html エクスプロイト https://ph4ntonn.github.io/CVE-2017-16995-exploit.html 構造...

CVE-2021-29155

これはCVE-2021-29155の概念実証コードです。 投機的実行領域におけるポインタ演算の範囲追跡システムは不十分でした。 サイドチャネル経由でカーネルデータを抽出することが可能でした。 これは概念実証であり、マップの最後の要素から先へ最大0x5fffバイトの範囲外読み取りができます。 この問題は5.12で修正され（https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=7fedb63a8307dda0ec3b8969a3b233a1dd7ea8...

CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: BPF 検証器の 1 バイトからコンテナエスケープへ Linux BPF 検証器にサウンドネスバグを発見しました。pushstack 呼び出し内の + 1 により、分岐したパスで ALU 命令が 1 つスキップされます。BPFOR の場合、CPU が 0 | K = K を計算している間、検証器は dst = 0 と追跡します。完全なコンテナエスケープを書き上げました。BPF マップからの OOB 読み書き、vtable ハイジャック、modprobepath 上書き、ホストでの root 取得です。その後、2 パッチのシリーズ（1 文字の検証器修正と 9...

CVE-2020-8835

CVE-2020-8835 Linuxカーネル5.5.0以降では、bpf検証器（kernel/bpf/verifier.c）が32ビット演算のレジスタ境界を適切に制限しないため、カーネルメモリ内での範囲外読み取りおよび書き込みが発生します。 この脆弱性は、導入コミットがそのブランチにバックポートされたため、v5.4.7以降のLinux 5.4安定シリーズにも影響します。 この脆弱性は、5.6.1、5.5.14、5.4.29で修正されました。 この脆弱性の緩和策は、「kernel.unprivilegedbpfdisabled」sysctlを「1」に設定することで利用可能です。...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1787291758)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1787291758 advisory. - The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known ...

CVE-2026-93125

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This vulnerability occurs because the verifier does not correctly handle certain buffer size arguments, allowing values larger than a 32-bit integer. When these oversized values are processed, they are truncated, leading ...

CVE-2026-98060

A flaw was found in the Linux kernel. A local user with permissions to load Berkeley Packet Filter BPF programs can cause a Denial of Service DoS or potentially achieve privilege escalation. The BPF verifier fails to prevent resilient lock operations within red-black tree comparison callbacks,...

CVE-2026-98048

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This vulnerability may allow a local user to achieve privilege escalation or cause a Denial of Service DoS through memory corruption. During helper call optimizations, the verifier improperly rewrites instruction sequence...

CVE-2026-98047

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier, which may allow a local attacker to cause a denial of service DoS or potentially escalate privileges. When verifying red-black tree rbtree callbacks, the verifier fails to enforce callback restrictions across nested...

CVE-2026-98044

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This issue allows a privileged local user to cause a Denial of Service DoS or unexpected program rejection by loading a specially crafted BPF program containing legacy packet-load instructions inside callback functions. D...

CVE-2026-98043

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier incorrectly assumes that certain pointer types are non-null without accounting for unbounded offsets that can wrap around to zero at runtime. A local user with permissions to load BPF programs can exploit thi...

CVE-2026-98042

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local user with permissions to load BPF programs could exploit this vulnerability to achieve privilege escalation or cause a denial of service DoS. The issue stems from improper handling of register states during...

CVE-2026-98041

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier incorrectly predicts that 32-bit conditional branch comparisons between a pointer and zero are always taken, failing to account for valid pointer values whose lower 32 bits can be zero. A local attacker could...

CVE-2026-98039

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. The verifier improperly validates pointer types when storing values into per-CPU map fields, allowing standard memory allocations or kernel pointers to be accepted as per-CPU data. A local user with permissions to load BP...

CVE-2026-98037

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. An improper validation check fails to reject untrusted allocated-object pointers after their protection scope expires, incorrectly recognizing them as valid live objects. A local user with permissions to load BPF programs...

CVE-2026-98019

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier failed to mark scalar registers as precise when checking null function arguments and specific helper call parameters, causing its state-tracking logic to improperly prune verification paths. A local attacker...

CVE-2017-16995

CVE-2017-16995 CVE ID: CVE-2017-16995 公開日: 2017-12-27T17:08:17.670 基本スコア CVSS 3.0/3.1: 7.8 説明: Linuxカーネル4.4までのkernel/bpf/verifier.c内のcheckaluop関数は、ローカルユーザーが不正な符号拡張を利用することで、サービス拒否（メモリ破損）を引き起こしたり、あるいはその他の未特定の影響を与える可能性があります。...

CVE-2026-98151

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. A local user can trigger a Denial of Service DoS or kernel verification failure by loading a specially crafted BPF program containing speculative pointer arithmetic. This issue occurs because register subregister bounds a...

CVE-2026-98134

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. During pointer register comparisons, the verifier can incorrectly deduce that a pointer cannot be null when it can actually be null at runtime. A local user with permissions to load BPF programs could exploit this flaw by...

CVE-2026-98132

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local attacker with permission to load BPF programs could exploit this flaw to achieve privilege escalation or cause a Denial of Service DoS. This issue arises when the verifier improperly handles scalar values stored o...