Linux Kernel BPF Function Tagging Vulnerability Leading to General Protection Fault

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation has been identified, specifically related to the handling of BTF (BPF Type Format) declaration tags for functions. This issue can lead to a general protection fault, likely caused by a non-canonical address. The vulnerability arises because the BTF declaration tag for function types does not have a proper 'resolve' callback, unlike struct, union, or variable types. When the BTF parser encounters an illegal function type declaration, it can trigger a null pointer dereference error, as the parser attempts to access a function prototype type that is out of range.

Impact

Exploitation of this vulnerability causes a general protection fault, leading to a null pointer dereference error. This type of error can often be exploited to cause a denial-of-service condition by crashing the system or application.

Reproduction

The vulnerability can be reproduced by loading an illegal BTF type declaration into the kernel. This can be done using the BPF syscall interface, specifically by creating a BTF type that includes a declaration tag pointing to a function type with an out-of-range function prototype. The kernel's BPF type parser will then encounter the illegal declaration, leading to the general protection fault and null pointer dereference error.

Remediation

Users should upgrade to the latest stable version of the Linux kernel where this vulnerability has been fixed.