## Summary
A Linux kernel eBPF verifier flaw allows constant negative offsets for buffer pointer accesses to bypass intended bounds checks. This can enable out-of-bounds reads/writes and incorrect accounting for writable raw tracepoint buffer access.
## Technical Details
- The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF, but it previously accepted a constant negative offset produced via pointer arithmetic.
- After commit 022ac0750883 (“bpf: use reg->var_off instead of reg->off for pointers”), constant pointer offsets moved from reg->off to reg->var_off.
- However, __check_buffer_access() continued to validate only the instruction offset, so an access with reg->var_off == -8 and instruction offset 0 could pass verification.
- For writable raw tracepoints, the access end was computed using the unsigned reg->var_off.value; an 8-byte access starting at -8 could wrap the calculated end to 0, letting the program load/attach without increasing max_tp_access.
- The fix ensures reg->var_off is constant, computes the effective access start using signed arithmetic, rejects negative starts, and uses the validated start to compute the access end for both PTR_TO_TP_BUFFER and PTR_TO_BUF.
- Code location indicated in the patch: kernel/bpf/verifier.c.
## Affected
- Linux kernel eBPF verifier logic for buffer pointer accesses involving PTR_TO_TP_BUFFER and PTR_TO_BUF.
- Fixes referenced: 022ac0750883.
- Stable backport note in references: Cc: [email protected] # 5.2.0.
## Impact
- Potential out-of-bounds memory access via eBPF programs (read/write), with incorrect verifier bounds for raw tracepoints.
- Incorrect max_tp_access accounting for writable raw tracepoints due to unsigned wraparound.
## Mitigation
1. Patch immediately with the verifier fix from commits 314bd592085c0720ef519f6edbc5f41440ff78d4 / fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9 (both describe the same change in kernel/bpf/verifier.c).
2. Restrict eBPF program loading to trusted users (PR:L, AV:L per CVSS vector), and audit any use of raw tracepoints.
3. After patching, re-test eBPF programs that access PTR_TO_TP_BUFFER / PTR_TO_BUF to ensure verifier behavior matches expected bounds enforcement.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H