bpf Jmp32 Bypass

Vulnerability analysis

The BPF verifier incorrectly predicts the outcome of 32-bit conditional jumps that compare a pointer against zero. Because the verifier treats 32-bit comparisons the same as 64-bit ones, it assumes a non-null pointer always compares unequal to zero — but the lower 32 bits of a valid pointer may legitimately be zero, causing the verifier to skip verifying a code path that should have been fully checked. A crafted program can exploit this to hide unsafe memory accesses on the unverified path, which then execute at runtime with out-of-bounds access to kernel memory. The fix makes the verifier decline to predict 32-bit pointer comparisons against zero, forcing it to analyze both possible branches. This is reachable by any process that can load BPF programs, which requires CAP_BPF; on systems allowing unprivileged BPF, an unprivileged local user or container can trigger it.