Linux eBPF JITȨÏÞÌáÉýÎó²î£¨CVE-2020-27194£©ÆÊÎöÓëÑéÖ¤

Ðû²¼Ê±¼ä 2020-11-03

Îó²îÅä¾°


¿ËÈÕ£¬£¬£¬£¬£¬£¬ÍâÑóÇå¾²Ñо¿Ö°Ô±Åû¶һ¸öLinux eBPF verifier×é¼þ¹ýʧÑéÖ¤Îó²î£¬£¬£¬£¬£¬£¬´ËÎó²îÔ´ÓÚbpfÑé֤ϵͳÔÚLinuxÄÚºËÖÐûÓÐ׼ȷÅÌËãijЩ²Ù×÷µÄ¼Ä´æÆ÷½çÏ߸ú×Ù£¬£¬£¬£¬£¬£¬µ¼ÖÂÍâµØ¹¥»÷Õß¿ÉÒÔʹÓôËȱÏݾÙÐÐÄÚºËÐÅϢй¶»òÌØÈ¨ÌáÉý£¬£¬£¬£¬£¬£¬¸ÃÎó²î±àºÅΪCVE-2020-27194¡£¡£¡£


Ó°Ïì¹æÄ£Óë·À»¤²½·¥


1¡¢Ó°Ïì¹æÄ£
  • Linux-5.7 ~ Linux-5.8.14

  • Ubuntu 20.10

2¡¢·À»¤²½·¥

  • ʵʱ¸üÐÂÉý¼¶Äںˣ»£»£»£»

  • ½«kernel.unprivileged_bpf_disabled.sysctlÉèÖÃΪ1£¬£¬£¬£¬£¬£¬ÔÝʱÏÞÖÆÍ¨Ë×Óû§È¨ÏÞ¡£¡£¡£

Îó²îÔ­ÀíÓëµ÷ÊÔÆÊÎö


1¡¢Îó²îÔ­Àí


¸ÃÎó²îºÍPwn2own2020½ÇÖðÖÐʹÓõÄCVE-2020-8835Îó²îÔ­ÀíÒ»Ö£¬£¬£¬£¬£¬£¬¾ùÊǹýʧÅÌËãÁ˼ĴæÆ÷½çÏ߸ú×Ù£¬£¬£¬£¬£¬£¬µ¼Ö¿ÉÒÔÈÆ¹ýÑéÖ¤Æ÷¼ì²éµÖ´ïÔ½½ç¶Áд¡£¡£¡£È±ÏÝ´úÂë·ºÆðÔÚkernel/bpf/verifier.cµÄscalar32_min_max_or()º¯ÊýÖУ¬£¬£¬£¬£¬£¬¸Ãº¯ÊýÊÇÔÚcommit_id£º3f50f132d840ÖÐÒýÈëµÄ£¬£¬£¬£¬£¬£¬¸Ã¹¦Ð§ÊµÏÖÁËÏÔʽµÄALU32(32λÅÌËãÀà²Ù×÷)¼Ä´æÆ÷½çÏ߸ú×Ù£¬£¬£¬£¬£¬£¬´¦Öóͷ£ORÔËËãʱ£¬£¬£¬£¬£¬£¬Å²ÓÃscalar32_min_max_or()º¯Êý¾ÙÐÐ32λ¼Ä´æÆ÷½çÏ߸ú×Ù£¬£¬£¬£¬£¬£¬¸Ãº¯ÊýʵÏÖÈçÏ£º



ÐÐ5365ºÍÐÐ5366£¬£¬£¬£¬£¬£¬Ö±½Ó½«dst_reg¼Ä´æÆ÷ÖеÄ64λÎÞ·ûºÅÖµ¸³Öµ¸ø32λÓзûºÅÖµ£¬£¬£¬£¬£¬£¬ÕâÏÔ×ÅÊǹýʧµÄ¡£¡£¡£ÀýÈçÉèÖÃdst_reg->umin_value=1£¬£¬£¬£¬£¬£¬dst_reg->umax_value=0x600000001£¬£¬£¬£¬£¬£¬µ±¾ÙÐÐÈçÉϲÙ×÷ºó£¬£¬£¬£¬£¬£¬dst_reg->s32_min_valueΪ1£¬£¬£¬£¬£¬£¬¿ÉÊÇdst_reg->s32_max_valueÒ²½«ÊÇ1£¬£¬£¬£¬£¬£¬ÓÉÓÚ0x600000001µÄ¸ß뽫±»½Ø¶Ï£¬£¬£¬£¬£¬£¬Õâʱdst_reg¼Ä´æÆ÷µÄ¹æÄ£´Ó[1,0x600000001]Äð³ÉÁË[1,1]£¬£¬£¬£¬£¬£¬Õâ»á±»ÑéÖ¤Æ÷ʶ±ðΪ³£Êý1£¬£¬£¬£¬£¬£¬½ø¶øÈƹýÑéÖ¤Æ÷¼ì²é¡£¡£¡£Îó²î²¹¶¡ÖУ¬£¬£¬£¬£¬£¬¾ÙÐÐÁË׼ȷµÄ32λÓзûºÅÖµ¸³Öµ²Ù×÷£¬£¬£¬£¬£¬£¬ÈçÏÂËùʾ£º


 


2¡¢µ÷ÊÔÆÊÎö


Ê×ÏȽ«¼Ä´æÆ÷µÄumin_valueÉèÖÃΪ0x1£¬£¬£¬£¬£¬£¬¿ÉÒÔͨ¹ýÈçÏÂBPFÖ¸ÁîʵÏÖ£º



´Ëʱ£¬£¬£¬£¬£¬£¬¼Ä´æÆ÷µÄ״̬ÈçÏÂËùʾ£º



ÉèÖÃÍêumin_valueºó£¬£¬£¬£¬£¬£¬ÉèÖÃumax_valueΪ0x600000001£¬£¬£¬£¬£¬£¬¿ÉÒÔͨ¹ýÈçÏÂBPFÖ¸ÁîʵÏÖ£º



¶ÏµãÖÀÖк󣬣¬£¬£¬£¬£¬Å²ÓÃÕ»ÈçÏÂËùʾ£º



Ö´ÐÐÍêBPF_JMP_REG(BPF_JLT,BPF_REG_6,BPF_REG_5,1)Ö¸Áîºó£¬£¬£¬£¬£¬£¬½«R6¼Ä´æÆ÷¹æÄ£ÉèÖÃΪ0x1µ½0x600000001Ö®¼ä¡£¡£¡£R6¼Ä´æÆ÷״̬ÈçÏÂËùʾ£º



½Ó×Å£¬£¬£¬£¬£¬£¬ÉèÖÃR6¼Ä´æÆ÷ÖÐ32λµÄÎÞ·ûºÅ×îСֵºÍ×î´óÖµ£¬£¬£¬£¬£¬£¬



ÉèÖÃÍêÖ®ºó£¬£¬£¬£¬£¬£¬R6¼Ä´æÆ÷״̬ÈçÏÂËùʾ£º



ºì¿òÖÐÉèÖõÄÖµÊDZØÐèÒª°ü¹ÜµÄ£¬£¬£¬£¬£¬£¬ÐèÒªÌáǰ¾ÙÐÐÉèÖ㬣¬£¬£¬£¬£¬Àû±ãºóÃæÈÆ¹ýifÅжϽøÈëȱÏÝ´úÂë¿éÖС£¡£¡£½Ó×ÅÉèÖÃR6¼Ä´æÆ÷32λÓзûºÅ×îСֵºÍ×î´óÖµ£¬£¬£¬£¬£¬£¬´úÂëÈçÏÂËùʾ£º



ÐÐ5355£¬£¬£¬£¬£¬£¬ifÓï¾äÅжϲ»½¨É裬£¬£¬£¬£¬£¬»á×ßµ½ÐÐ5362·ÖÖ§ÖУ¬£¬£¬£¬£¬£¬µ÷ÊÔÇéÐÎÈçÏÂËùʾ£º



´¥·¢Îó²îºó£¬£¬£¬£¬£¬£¬R6¼Ä´æÆ÷״̬ÈçÏ£º



´Ëʱs32_min_valueºÍs32_max_value¶¼Îª0x1£¬£¬£¬£¬£¬£¬ÔÚÑéÖ¤Æ÷ÖУ¬£¬£¬£¬£¬£¬R6¼Ä´æÆ÷µÄ32λÓзûºÅȡֵΪ³£Êý1¡£¡£¡£µ«R6¼Ä´æÆ÷µÄȡֵÏÖʵÊÇÓйæÄ£µÄ¡£¡£¡£½Ó׎«R6¼Ä´æÆ÷¾ÙÐÐ32λMOVµ½R7¼Ä´æÆ÷ÖУ¬£¬£¬£¬£¬£¬Ö´Ðе½ÈçÏ´úÂëËùʾ£º



´Ëʱ£¬£¬£¬£¬£¬£¬src_reg¼Ä´æÆ÷ÈçÏÂËùʾ£º



Ö´ÐÐMOV²Ù×÷֮ǰ£¬£¬£¬£¬£¬£¬R7¼Ä´æÆ÷״̬ÈçÏÂËùʾ£º



Ö´ÐÐMOV²Ù×÷ºó£¬£¬£¬£¬£¬£¬R7¼Ä´æÆ÷״̬ÈçÏÂËùʾ£º


R7¼Ä´æÆ÷Ϊ³£Á¿1£¬£¬£¬£¬£¬£¬ÏÖʵÔËÐÐÇéÐÎÏÂÊÇÓйæÄ£µÄ£¬£¬£¬£¬£¬£¬¿ÉÒÔÉèÖÃΪ2¡£¡£¡£Ö´ÐÐBPF_ALU64_IMM(BPF_RSH,BPF_REG_7,1)ºó£¬£¬£¬£¬£¬£¬¼´R7 >>= 1£¬£¬£¬£¬£¬£¬R7¼Ä´æÆ÷ÈçÏÂËùʾ£º



´Ëʱumin_valueºÍumax_valueΪ0£¬£¬£¬£¬£¬£¬¼´ÎªR7¼Ä´æÆ÷¾ÙÐÐÓÒÒÆ²Ù×÷ºó£¬£¬£¬£¬£¬£¬ÔÚÑéÖ¤Æ÷Öб»Ê¶±ðΪ³£Êý0£¬£¬£¬£¬£¬£¬´ËʱR7¼Ä´æÆ÷¾ÙÐмӼõÔËËã¶¼²»»á±¬·¢Ô½½ç£¬£¬£¬£¬£¬£¬ÈƹýÁËÑéÖ¤Æ÷µÄ½çÏß¼ì²é¡£¡£¡£¿ÉÊÇÈôÊÇR7¼Ä´æÆ÷ÏÖʵÉèÖÃΪ2£¬£¬£¬£¬£¬£¬2>>1Ϊ1£¬£¬£¬£¬£¬£¬R7¼Ä´æÆ÷Ϊ1£¬£¬£¬£¬£¬£¬´ËʱºÍR7¼Ä´æÆ÷¾ÙÐмӼõÔËË㣬£¬£¬£¬£¬£¬µÖ´ïÔ½½ç¶Áд¡£¡£¡£


Îó²î¸´ÏÖ


ÔÚLinux-5.7.7°æ±¾ÖоÙÐÐÎó²îʹÓ㬣¬£¬£¬£¬£¬ÀÖ³ÉÌáȨ¡£¡£¡£



²Î¿¼Á´½Ó£º


[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27194

[2] https://github.com/torvalds/linux/commit/5b9fbeb75b6a98955f628e205ac26689bcb1383e

[3] https://github.com/torvalds/linux/commit/3f50f132d8400e129fc9eb68b5020167ef80a244

[4] https://scannell.me/fuzzing-for-ebpf-jit-bugs-in-the-linux-kernel/


¿­Ðý¹ú¼ÊÓÎÏ·Æð¾¢·ÀÓùʵÑéÊÒ£¨ADLab£©


ADLab½¨ÉèÓÚ1999Ä꣬£¬£¬£¬£¬£¬ÊÇÖйúÇå¾²ÐÐÒµ×îÔ罨ÉèµÄ¹¥·ÀÊÖÒÕÑо¿ÊµÑéÊÒÖ®Ò»£¬£¬£¬£¬£¬£¬Î¢ÈíMAPPÍýÏë½¹µã³ÉÔ±£¬£¬£¬£¬£¬£¬¡°ºÚȸ¹¥»÷¡±¿´·¨Ê×ÍÆÕß¡£¡£¡£×èÖ¹ÏÖÔÚ£¬£¬£¬£¬£¬£¬ADLabÒÑͨ¹ýCVEÀÛ¼ÆÐû²¼Çå¾²Îó²î½ü1100¸ö£¬£¬£¬£¬£¬£¬Í¨¹ý CNVD/CNNVDÀÛ¼ÆÐû²¼Çå¾²Îó²î900Óà¸ö£¬£¬£¬£¬£¬£¬Ò»Á¬¼á³Ö¹ú¼ÊÍøÂçÇå¾²ÁìÓòÒ»Á÷Ë®×¼¡£¡£¡£ÊµÑéÊÒÑо¿Æ«Ïòº­¸Ç²Ù×÷ϵͳÓëÓ¦ÓÃϵͳÇå¾²Ñо¿¡¢Òƶ¯ÖÇÄÜÖÕ¶ËÇå¾²Ñо¿¡¢ÎïÁªÍøÖÇÄÜ×°±¸Çå¾²Ñо¿¡¢WebÇå¾²Ñо¿¡¢¹¤¿ØÏµÍ³Çå¾²Ñо¿¡¢ÔÆÇå¾²Ñо¿¡£¡£¡£Ñо¿Ð§¹ûÓ¦ÓÃÓÚ²úÆ·½¹µãÊÖÒÕÑо¿¡¢¹ú¼ÒÖØµã¿Æ¼¼ÏîÄ¿¹¥¹Ø¡¢×¨ÒµÇ徲ЧÀ͵È¡£¡£¡£


1.jpg