Hacker News Reader

Hacker News

Comment by djhworld | Hacker News Reader

Full thread

djhworld

Is there an explanation of what this is exploiting?

View on HN

It's a double free in bpf.

Here's some slides from the author (from last week) with a more in depth explanation:

http://crack.bargains/02r0.pdf

Much more interesting than the raw code. I'd replace the link if I were a mod.

Thanks, that was a really epic read (and pretty close to line noise for me as a security-agnostic person).

I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface, it's a character special device used to control the kernel's network filtering.

[1] https://www.freebsd.org/cgi/man.cgi?bpf(4)

These also exist in the Linux kernel (bpf/ebpf)

And of course also caused problems there. Check Project Zero advisories (iirc found by jhorn).

BPF in Linux has been expanded to let you run pieces of user supplied code in the kernel. Its moved a bit away from the original definition of raw packet filtering.

That's eBPF ("extended"). Unfortunately, "BPF" is commonly used to refer to both.

> I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface

Nah, it's the Berkeley Packet Filter interface. It predates FreeBSD; just check out the HISTORY section of the manual page you linked. FreeBSD's first release was in 1993; BPF was implemented in 1990, with roots going back to 1980 (enet).

https://svnweb.freebsd.org/csrg?view=revision&revision=47584

https://svnweb.freebsd.org/csrg?view=revision&revision=47585

(Note that the /csrg repo in FreeBSD's SVN is history of the original BSD project, pre-FreeBSD itself.)

As other commenters have noted, Linux has adopted it as well. They've added a bunch of extensions in "eBPF," or extended BPF.

There's a full explanation for the previous vulnerable FW 4.55 but the defect is the same (IIRC) as Sony properly fixed the race condition only with FW 5.50.

https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...

and of the previous 4.05 https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...

Reply on news.ycombinator.com