Linux 7.2-rc2 hardens BPF against JIT-spraying attacks

Ahead of the Linux 7.2-rc2 test build, changes related to the security of the BPF subsystem have been merged into the mainline kernel. As the publication Phoronix reports, these fixes landed after the merge window had already closed and are aimed at protecting against JIT spraying attacks.

What we know

The BPF JIT compiler translates program bytecode into machine instructions that run directly on the processor. JIT spraying attacks exploit the predictability of the code generated by the JIT compiler, placing in executable memory fragments that an attacker can later use to bypass memory protection mechanisms.

According to Phoronix, the changes introduced on the eve of the 7.2-rc2 release are aimed precisely at making such exploitation scenarios against kernel BPF code harder to pull off.

Context

BPF (Berkeley Packet Filter) has long moved beyond its original purpose — filtering network packets — and is used in the Linux kernel for tracing, performance monitoring, network routing and implementing security policies. Because of its wide use and the high privileges with which BPF programs can run, this subsystem regularly draws the attention of security researchers, and hardening it is among the kernel maintainers' priorities.

Details about the specific implementation of the proposed protective measures, as well as which vulnerable scenarios they close off, are not provided in the published material. The changes were folded into the codebase as part of preparing the 7.2-rc2 release candidate, which points to the prompt nature of the fix even after the merge window for this kernel version had formally closed.

Source: Phoronix