libbpf CVE-2021-33411 Kernel Buffer Overflow in bpf_prog_load with POC

CVE-2021-33411 漏洞总结 漏洞概述 该漏洞存在于 库的 函数中，具体位于 文件。攻击者可以通过构造特殊的 BPF 程序，利用 函数中的缓冲区溢出漏洞，导致内核崩溃或执行任意代码。 影响范围 受影响版本: 库的早期版本（具体版本未明确列出，但通常指 0.4 之前的版本）。 受影响系统: 使用 库的 Linux 系统，特别是那些运行 BPF 程序的系统。 修复方案 官方补丁: 建议升级到 的最新版本，以获取官方提供的安全补丁。 临时缓解措施: 如果无法立即升级，可以禁用或限制 BPF 程序的使用，以减少潜在的攻击面。 POC 代码 ```c #include #include #include #include #include #include #include #include #define BPF_MAP_TYPE_ARRAY 2 #define BPF_MAP_TYPE_HASH 1 #define BPF_MAP_TYPE_PROG_ARRAY 3 #define BPF_MAP_TYPE_PERF_EVENT_ARRAY 4 #define BPF_MAP_TYPE_PERCPU_HASH 5 #define BPF_MAP_TYPE_PERCPU_ARRAY 6 #define BPF_MAP_TYPE_LPM_TRIE 7 #define BPF_MAP_TYPE_ARRAY_OF_MAPS 8 #define BPF_MAP_TYPE_HASH_OF_MAPS 9 #define BPF_MAP_TYPE_DEVMAP 10 #define BPF_MAP_TYPE_SOCKMAP 11 #define BPF_MAP_TYPE_CPUMAP 12 #define BPF_MAP_TYPE_XSKMAP 13 #define BPF_MAP_TYPE_SOCKHASH 14 #define BPF_MAP_TYPE_CGROUP_STORAGE 15 #define BPF_MAP_TYPE_LRU_HASH 16 #define BPF_MAP_TYPE_LRU_PERCPU_HASH 17 #define BPF_MAP_TYPE_LPM_TRIE 18 #define BPF_MAP_TYPE_QUEUE 19 #define BPF_MAP_TYPE_STACK 20 #define BPF_MAP_TYPE_RINGBUF 21 #define BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE 22 #define BPF_MAP_TYPE_LOCAL_STORAGE 23 #define BPF_MAP_TYPE_LOCAL_STORAGE_PERCPU 24 struct bpf_map_def { int type; int key_size; int value_size; int max_entries; int map_flags; }; struct bpf_prog_load_attr { __u32 prog_type; __u32 insn_cnt; __u64 insns; __u64 license; __u32 kern_version; __u32 prog_flags; __u32 prog_name; __u32 prog_ifindex; __u32 prog_attach_type; __u32 prog_attach_flags; __u32 prog_attach_fd; __u32 prog_attach_prog_fd; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_type; __u32 prog_attach_target_flags; __u32 prog_attach_target_fd; __u32 prog_attach_target_ty

目標達成すべての支援者に感謝 — 100%達成しました！

libbpf CVE-2021-33411 Kernel Buffer Overflow in bpf_prog_load with POC

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

libbpf CVE-2021-33411 Kernel Buffer Overflow in bpf_prog_load with POC

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！