Linux Kernel Version 4.14 - 4.4 (Ubuntu && Debian)

Description

This vulnerability exists in the eBPF bpf(2) system call in the Linux kernel. When a user provides a malicious BPF program that causes a calculation error in the eBPF verifier module, it leads to arbitrary memory read/write issues. Unprivileged users can use this vulnerability to escalate privileges. This vulnerability was discovered by Google Project Zero.

Vulnerability ID

CVE-2017-16995

Threat Level

High

Demo

bearcat@ubuntu:/opt$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.4 LTS
Release:        16.04
Codename:       xenial
bearcat@ubuntu:/opt$ uname -a
Linux ubuntu 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
bearcat@ubuntu:/opt$ id
uid=1000(bearcat) gid=1000(bearcat) groups=1000(bearcat),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare)
bearcat@ubuntu:/opt$ ls
exploit.c
bearcat@ubuntu:/opt$ gcc exploit.c -o exploit
bearcat@ubuntu:/opt$ ./exploit
task_struct = ffff88003a0db800
uidptr = ffff8800374b76c4
spawning root shell
root@ubuntu:/opt# id
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare),1000(bearcat)
root@ubuntu:/opt#

Remediation Suggestions

Currently, there is no clear patch upgrade solution. It is recommended that users evaluate the risk and limit ordinary users' access to the bpf(2) system call by modifying kernel parameters:

Set the parameter "kernel.unprivileged_bpf_disabled = 1" to prevent this privilege escalation by restricting access to the bpf(2) call.

root@Ubuntu# echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled