CVE-2021-47608

What it actually does

The flaw permits unprivileged BPF programs to leak kernel pointers by bypassing verifier checks in atomic fetch operations on spilled stack pointers, converting pointer types to scalars that can be exported via maps.

Why it matters to the business

Attackers with local access can obtain kernel memory layout information, facilitating follow-on exploits that compromise system confidentiality and increase the likelihood of privilege escalation or persistent access.

How an attack unfolds

An attacker loads a crafted BPF program performing an atomic fetch/and with -1 against a stack slot containing a spilled pointer; the buggy check_mem_access path treats the result as a scalar, allowing the pointer value to be read out through a map value without triggering pointer-type restrictions.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the check_mem_access handling in atomic fetch operations (addressed via double-check with placeholder -1 for BPF_READ followed by actual load). Restrict unprivileged BPF loading via kernel config or sysctl where feasible until patched.

How to confirm the fix worked

Confirm kernel version includes the referenced commit resolving the BPF_FETCH pointer propagation issue; test by attempting to load a BPF program that previously triggered the leak and verify rejection under the fixed verifier logic.

Typical attack path

1. Obtain unprivileged local access to a Linux system
2. Craft and load a BPF program using atomic fetch operations on spilled pointers
3. Trigger verifier path that migrates pointer to scalar type
4. Dump scalar value to a BPF map for exfiltration
5. Use leaked addresses to inform subsequent kernel exploits

How to detect it

Audit kernel logs and auditd records for bpf() syscalls loading programs with atomic fetch operations; inspect verifier error paths or unusual map read activity following BPF program attachment; correlate with threat actor patterns involving kernel pointer leaks.

What your security team should do

• Apply kernel updates containing the BPF verifier fix as soon as available
• Disable unprivileged BPF loading (kernel.unprivileged_bpf_disabled=1) on systems where functionality is not required
• Monitor bpf() syscall usage for anomalous program loads
• Review and harden systems with high EPSS or exposure to local attackers