microsoft / microsoft/ebpf-for-windows
ebpf_program_test_run of PROG_TYPE_SAMPLE leaks kernel pointers
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the bug
Seems like executing a `sample` program via ebpf_program_test_run leaks kernel addresses via the `context_out` parameter.
### OS information
_No response_
### Steps taken to reproduce bug
- Load `SAMPLE` type program
- Allocate ebpf_test_run_options_t with context_out present
- Call ebpf_program_test_run
- Interpret ebpf_test_run_options_t.context_out as `*sample_program_context_t`.
- Find leaked pointers in data_start and data_end
### Expected behavior
`context_out` should not contain kernel addresses.
### Actual outcome
It does contain something that looks suspiciously like kernel addresses:
```
got:
&ebpf.winSampleProgramContext{DataStart:0xffffd6823d25d32a, DataEnd:0xffffd6823d25d339, Uint32Data:0x0, Uint16Data:0x0, _:0x0, HelperData1:0x0, HelperData2:0x0}
want:
&ebpf.winSampleProgramContext{DataStart:0x0, DataEnd:0xf, Uint32Data:0x0, Uint16Data:0x0, _:0x0, HelperData1:0x0, HelperData2:0x0}
```
(This is from a unit test of ebpf-go.)
### Additional details
This could help an attacker defeat kernel-level ASLR.
Contributor guide
Assessment
This issue has not been assessed yet.