BPF tcx/netkit Detach Permission Bypass Fix

Mitigation Strategies

The vulnerability is fixed by adding a capability check for CAP_NET_ADMIN or CAP_SYS_ADMIN when detaching BPF programs on tcx or netkit devices without a program file descriptor.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's handling of BPF (Berkeley Packet Filter) program detach operations on tcx or netkit devices. Specifically, when a user attempts to detach a BPF program without providing a program file descriptor (fd), the system incorrectly allows any user to perform the detach operation without proper permission checks.

The issue was that the BPF_PROG_DETACH operation could be executed by any user if no program fd was given, effectively bypassing the intended permission checks. The fix introduced a capability check requiring the user to have either CAP_NET_ADMIN or CAP_SYS_ADMIN privileges to perform the detach in such cases.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to detach BPF programs from tcx or netkit devices without proper permissions. This could lead to disruption or manipulation of network filtering or monitoring functions that rely on BPF programs, potentially impacting system security or network behavior.

Useful 0 Not Useful 0