4 ms·
This is about CVE-2021-3490: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3490 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3490
by ericbarrett 5y ago
This is about CVE-2021-3490: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3490 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3490
- tptacek 5y agoIt's a truly excellent bug, a gnarly logic problem (it superficially looks like a 32/64 problem, but it's really just a logic bug that follows those same contours) that kind of betrays how brittle the eBPF verifier is. I look at this bug and what it shows about the assumptions baked into eBPF verification and conclude that it is not safe for unprivileged programs to use. What's nice is, this bug says nothing about the verifier's ability to protect kernel stability from stupid, rather than malicious, code. Which, for 99% of eBPF applications, is all you care about! It's still a great way to let systems programmers extend the kernel.
- staticassertion 5y ago> I look at this bug and what it shows about the assumptions baked into eBPF verification and conclude that it is not safe for unprivileged programs to use. This is actually something we took away from this (I work at Grapl) as well. We consider the Linux kernel to be unsuitable for isolation in some of our services, and it at least requires hardening (such as limiting unprivileged ebpf) in others.