EUVD-2026-70243Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Assumes prevail gates untrusted, remotely-submittable eBPF (AV:N/PR:N); accepted OOB deref gives C:H/I:H and plausible crash A:L; scope unchanged as impact is within the eBPF host.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address - and prevail will report the program as safe. This issue has been patched in version 0.2.4.
AnalysisAI
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an attacker get an unsafe eBPF program accepted as safe. The abstract transformer treats stores through a context-typed (T_CTX) base register as a silent no-op, so a program can overwrite a context pointer field such as ctx->data, reload it typed as a packet pointer (T_PACKET), and dereference an attacker-controlled address while prevail still reports PASS, enabling out-of-bounds memory access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that PRESail be used to verify eBPF programs supplied by the attacker - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:N, score 9.3) reflects worst-case deployment where prevail sits behind a network service that accepts and verifies untrusted eBPF; in that model an unauthenticated attacker who can submit a program achieves both confidentiality (OOB read of attacker-chosen addresses) and integrity (memory corruption via reloaded packet pointer) impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to PREVAIL 0.2.4 or later (https://github.com/vbpf/prevail/releases/tag/v0.2.4), which adds write-time rejection of stores that may overlap the read-only ctx pointer slots (data/data_end/meta) and models atomic read-modify-write instructions as writes so they are checked the same way (commit de65234f67d2608b54d12571edb585ead224363c). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running PREVAIL eBPF verifier and document current versions deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier i
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access
Same weakness CWE-682 – Incorrect Calculation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today