microsoft / microsoft/ebpf-for-windows

ebpf_program_test_run of PROG_TYPE_SAMPLE leaks kernel pointers

Open
#4,735 1 comment 0 reactions 1 assignee Claimed by @nmlud21 View on GitHub
bug P3 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the bug

Seems like executing a `sample` program via ebpf_program_test_run leaks kernel addresses via the `context_out` parameter.

### OS information

_No response_

### Steps taken to reproduce bug

- Load `SAMPLE` type program
- Allocate ebpf_test_run_options_t with context_out present
- Call ebpf_program_test_run
- Interpret ebpf_test_run_options_t.context_out as `*sample_program_context_t`.
- Find leaked pointers in data_start and data_end

### Expected behavior

`context_out` should not contain kernel addresses.

### Actual outcome

It does contain something that looks suspiciously like kernel addresses:

```
got:
&ebpf.winSampleProgramContext{DataStart:0xffffd6823d25d32a, DataEnd:0xffffd6823d25d339, Uint32Data:0x0, Uint16Data:0x0, _:0x0, HelperData1:0x0, HelperData2:0x0}
want:
&ebpf.winSampleProgramContext{DataStart:0x0, DataEnd:0xf, Uint32Data:0x0, Uint16Data:0x0, _:0x0, HelperData1:0x0, HelperData2:0x0}
```

(This is from a unit test of ebpf-go.)

### Additional details

This could help an attacker defeat kernel-level ASLR.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.