6 ms·
BPF in the kernel was just for the sake of expediency. The point is that the BPF code shows a somewhat common pattern that real kernel code also uses. The “real
by pdpi 9y ago
BPF in the kernel was just for the sake of expediency. The point is that the BPF code shows a somewhat common pattern that real kernel code also uses. The “real” exploit is finding a syscall that falls into that pattern somewhere
- monocasa 9y agoAbsolutely. There's memory unsafety bugs that'll allow you to ROP, and probably otherwise valid code that doesn't need unsafety that'll speculatively hit user memory in current kernels. But in the context of trends, we're moving towards User^Kernel memory mapping with features SMAP. That idea combined with kernel changes to holistically enforce separation boundaries more effectively along with cache partitioning AFAICT leads to potential end game win on this front. Edit: And to be totally up front my major side project is adding a BPF/seccomp esque virtual machine into a formally verified kernel, so my head is in that space.