Linux eBPF bug gets root privileges on Ubuntu - Exploit released

guest · Jul 30, 2021

Linux eBPF bug gets root privileges on Ubuntu - Exploit released
July 30, 2021
https://www.bleepingcomputer.com/ne...s-root-privileges-on-ubuntu-exploit-released/

A security researcher released exploit code for a high-severity vulnerability in Linux kernel eBPF (Extended Berkeley Packet Filter) that can give an attacker increased privileges on Ubuntu machines.
The bug is tracked as CVE-2021-3490. It was disclosed in May and is a privilege escalation, so leveraging it requires local access on the target machine.

eBPF is a technology that enables user-supplied programs to run sandboxed inside the operating system’s kernel, triggered by a specific event or function (e.g. system call, network events).
Click to expand...

Denial-of-service also possible
Manfred Paul of the RedRocket CTF team working with Trend Micro's Zero Day Initiative reported the bug. They found that CVE-2021-3490 could be turned into out-of-bounds reads and writes in the kernel.

In a blog post this week, exploit developer Valentina Palmiotti, describes the technical details behind CVE-2021-3490 and its exploitation on Ubuntu short-term releases 20.10 (Groovy Gorilla) and 21.04 (Hirsute Hippo).
Click to expand...

Her research into this bug also covers the specifics for triggering the vulnerability to leverage it for elevated privileges and to create a denial-of-service (DoS) condition on the target system by locking up all available kernel threads.
The researcher created proof-of-concept exploit code for CVE-2021-3490 and published it on GitHub.

The PoC works is designed for Groovy Gorilla kernels 5.8.0-25.26 through 5.8.0-52.58, and Hirsute Hippo kernel version 5.11.0-16.17. Patches were released for both Ubuntu versions.
Click to expand...

Kernel Pwning with eBPF: a Love Story

This blog post is intended to give a detailed overview of eBPF from the perspective of an exploit developer.

Since the introduction of eBPF, there have been a number of privilege escalation attacks that leverage the technology. In addition to exploiting vulnerabilities in eBPF itself, it also represents a powerful primitive for exploiting other kernel vulnerabilities. While eBPF can be a great tool for developers, there’s still more work to be done to harden it further.
Click to expand...

Log in or Sign up

Linux eBPF bug gets root privileges on Ubuntu - Exploit released

guest Guest

Log in or Sign up

Linux eBPF bug gets root privileges on Ubuntu - Exploit released

guest Guest

Useful Searches