ubpf
ubpf copied to clipboard
Inconsistences in arithmetic shift implementation of interpreter
In the upstream kernel eBPF specification, the offset of the arithmetic shift should be mask 0
In the interpreter of ubpf, the mask is missing for EBPF_OP_ARSH64 and EBPF_OP_ARSH
https://github.com/iovisor/ubpf/blob/a6082a2124e25045161a4ea9aa1a5a7dbd995379/vm/ubpf_vm.c#L572-L577 https://github.com/iovisor/ubpf/blob/a6082a2124e25045161a4ea9aa1a5a7dbd995379/vm/ubpf_vm.c#L475-L482
We should mask the src/imm offset before performing shift operation.
The following PoC program implies the differences between the specification and the implementation, while the program executed in the ubpf will trigger undefined behavior since the shift offset overflows.
mov64 r8, 0x05454500
alsh64 r8, r8
exit