CVE-2021-33624: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-33624 is a vulnerability discovered in the Linux kernel's BPF verifier before version 5.12.13, where an unprivileged BPF program can read arbitrary memory locations via a side-channel attack. The vulnerability was discovered by multiple researchers including Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk, and was disclosed in June 2021 (Openwall List, NVD).

The vulnerability exists in kernel/bpf/verifier.c where a branch can be mispredicted due to type confusion. The BPF verifier's protection against speculative execution attacks can be bypassed because it only enumerates valid control-flow paths and skips paths that are unreachable in the non-speculative domain. When analyzing a memory load instruction, the paths inspected by the verifier could use an address register that is always in-bounds, but a path missed by the verifier could put an arbitrary attacker-controlled scalar into the address register before a branch that mispredicts to the load instruction (Github Commit).

The vulnerability allows an unprivileged attacker to read and leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel attack. This could lead to exposure of sensitive information from the kernel memory (Openwall List).

A reliable attack has been demonstrated using crafted BPF programs that exploit branch misprediction. The attack requires mistraining the branch predictor, which can be done at congruent addresses in user space using different branches that are not mutually exclusive. Multiple proof-of-concept exploits were privately shared with the BPF maintainers to assist in developing the fix (Github Commit).

The vulnerability was fixed in Linux kernel version 5.12.13 through a patch series that implements proper handling of speculative paths in the BPF verifier. For systems that cannot immediately update, the vulnerability can be mitigated by setting sysctl kernel.unprivileged_bpf_disabled=1, which disables eBPF use by unprivileged users (Debian LTS).