BPF LSH/RSH shift amount unbounded: shift-by->=32 is undefined behavior
Summary
bpf_validate (:555-576) accepts BPF_LSH/BPF_RSH with no upper bound on shift count. Interpreter: A<<=X (:443) A>>=X (:447) A<<=pc->k (:475) A>>=pc->k (:479). X settable any value via BPF_LDX|BPF_IMM or BPF_LEN; pc->k bounded only by bpf_maxbufsize 0x80000 far above 31. Shift>=32 = C UB. x86 hardware masks count to 5 bits deterministic no mem-unsafety. UBSan flags it compiler technically free to exploit. No demonstrated security impact: shifted A is pure 32-bit register used as comparison/store/return(snaplen clamped). Privileged BIOCSETF. Fix: validator reject k>=32 + interpreter mask X&31.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0675 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 390 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/bpf_filter.c:443: BPF LSH/RSH shift amount unbounded (shift-by->=32 is UB)
Verified recommended fix
Source-confirmed at sys/net/bpf_filter.c:443: BPF LSH/RSH shift amount unbounded (shift-by->=32 is UB)
Verdict
Source-confirmed at sys/net/bpf_filter.c:443: BPF LSH/RSH shift amount unbounded (shift-by->=32 is UB)
No comments yet.