| Severity |
|
| Remote |
|
| Type |
|
| Description |
| + |
It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.73 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." |
|
| References |
| + |
https://bugs.chromium.org/p/project-zero/issues/detail?id=1454 |
| + |
http://www.openwall.com/lists/oss-security/2017/12/21/2 |
| + |
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=37435f7e80ef9adc32a69013c18f135e3f434244 |
|
| Notes |
| + |
Workaround by disabling unprivileged bpf: |
| + |
sysctl -w kernel.unprivileged_bpf_disabled=1 |
|