Vbpf
Monthly
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access - including unprivileged users on BPF-enabled kernels - to load programs that incorrectly pass safety checks but destroy the upper 32 bits of kernel pointer registers at runtime via ALU32 ADD and SUB instructions. The runtime effect is either a program fault (availability impact) or exposure of the lower 32 bits of a kernel pointer as a leakable scalar, partially defeating kernel ASLR. A vendor patch is available at v0.2.4; no active exploitation or public exploit code has been identified at time of analysis.
Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. {ctx, shared} or a {number, pointer} union - EbpfTransformer::add() silently skips updating the pointer offset variable, leaving a stale pre-add offset. Subsequent bounds checks reason from that stale offset and accept out-of-bounds memory accesses, so a crafted BPF program that would corrupt memory at runtime is incorrectly accepted as safe; the fix landed in 0.2.4 and no public exploit has been identified.
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an attacker get an unsafe eBPF program accepted as safe. The abstract transformer treats stores through a context-typed (T_CTX) base register as a silent no-op, so a program can overwrite a context pointer field such as ctx->data, reload it typed as a packet pointer (T_PACKET), and dereference an attacker-controlled address while prevail still reports PASS, enabling out-of-bounds memory access. Fixed in 0.2.4; no public exploit identified at time of analysis beyond the maintainer's regression test cases, which concretely demonstrate the bypass shape.
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access - including unprivileged users on BPF-enabled kernels - to load programs that incorrectly pass safety checks but destroy the upper 32 bits of kernel pointer registers at runtime via ALU32 ADD and SUB instructions. The runtime effect is either a program fault (availability impact) or exposure of the lower 32 bits of a kernel pointer as a leakable scalar, partially defeating kernel ASLR. A vendor patch is available at v0.2.4; no active exploitation or public exploit code has been identified at time of analysis.
Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. {ctx, shared} or a {number, pointer} union - EbpfTransformer::add() silently skips updating the pointer offset variable, leaving a stale pre-add offset. Subsequent bounds checks reason from that stale offset and accept out-of-bounds memory accesses, so a crafted BPF program that would corrupt memory at runtime is incorrectly accepted as safe; the fix landed in 0.2.4 and no public exploit has been identified.
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an attacker get an unsafe eBPF program accepted as safe. The abstract transformer treats stores through a context-typed (T_CTX) base register as a silent no-op, so a program can overwrite a context pointer field such as ctx->data, reload it typed as a packet pointer (T_PACKET), and dereference an attacker-controlled address while prevail still reports PASS, enabling out-of-bounds memory access. Fixed in 0.2.4; no public exploit identified at time of analysis beyond the maintainer's regression test cases, which concretely demonstrate the bypass shape.