CVE-2021-47607

What it actually does

The BPF verifier fails to reject unprivileged programs that place a pointer value into R0 when using the atomic CMPXCHG instruction, allowing the old value returned from a memory location to leak a kernel address into userspace-controlled maps.

Why it matters to the business

Local attackers on affected Linux systems can obtain kernel memory addresses that simplify the development of exploits for privilege escalation or container escape, increasing the risk of full system compromise in multi-tenant or cloud environments.

How an attack unfolds

An attacker compiles an unprivileged BPF program that stores a guessed kernel address into a map slot, loads it into R0, performs CMPXCHG against a chosen memory location with a distinguishable canary in the source register, and repeats with different guesses until the returned value matches the canary, confirming a valid kernel pointer in roughly 16 seconds.

How to fix it

Upgrade to a Linux kernel containing the fix that adds an explicit check rejecting pointer values in R0 for unprivileged BPF programs; rebuild and redeploy any custom kernels or distributions that include the vulnerable BPF verifier logic.

How to confirm the fix worked

Confirm the presence of the pointer check in the verifier code for BPF_CMPXCHG or verify that unprivileged programs attempting to place pointers in R0 are rejected at load time; test with the published PoC to ensure leakage no longer occurs.

Typical attack path

1. Obtain unprivileged access to load BPF programs (e.g., via CAP_BPF or user namespaces)
2. Create a BPF map to hold scalar values and guessed addresses
3. Craft and load a BPF program using atomic CMPXCHG that places a pointer in R0
4. Iterate over address guesses while observing map contents for successful leaks
5. Use recovered kernel pointers to craft subsequent exploits such as ROP chains or info leaks

How to detect it

Inspect kernel audit logs or BPF event traces for programs loaded by unprivileged users that contain atomic CMPXCHG instructions; correlate with map update patterns that store and retrieve scalar values in rapid succession indicative of address probing.

What your security team should do

• Apply the upstream BPF verifier fix to all production kernels immediately
• Restrict unprivileged BPF loading via sysctl or LSM policies where feasible
• Monitor for unusual BPF program loads from non-root users
• Review container runtime configurations that permit user namespaces and BPF