It's a double free in bpf.
Here's some slides from the author (from last week) with a more in depth explanation:
back
2 comments
Thanks, that was a really epic read (and pretty close to line noise for me as a security-agnostic person).
I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface, it's a character special device used to control the kernel's network filtering.
> I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface
Nah, it's the Berkeley Packet Filter interface. It predates FreeBSD; just check out the HISTORY section of the manual page you linked. FreeBSD's first release was in 1993; BPF was implemented in 1990, with roots going back to 1980 (enet).
https://svnweb.freebsd.org/csrg?view=revision&revision=47584
https://svnweb.freebsd.org/csrg?view=revision&revision=47585
(Note that the /csrg repo in FreeBSD's SVN is history of the original BSD project, pre-FreeBSD itself.)
As other commenters have noted, Linux has adopted it as well. They've added a bunch of extensions in "eBPF," or extended BPF.
BPF in Linux has been expanded to let you run pieces of user supplied code in the kernel. Its moved a bit away from the original definition of raw packet filtering.
That's eBPF ("extended"). Unfortunately, "BPF" is commonly used to refer to both.
These also exist in the Linux kernel (bpf/ebpf)
And of course also caused problems there. Check Project Zero advisories (iirc found by jhorn).
Much more interesting than the raw code. I'd replace the link if I were a mod.