Notes on BPF and eBPF

Re:Notes on BPF and eBPF by stefan_ on Sunday January 02, 2022 @08:02PM (#29776085)

I think they already don't. eBPF has become a favorite jumping point for exploit chains that can very quickly escalate some read/write gadget into full execution.

[ Parent | on HN ]

Re:Notes on BPF and eBPF by kingforaday on Sunday January 02, 2022 @09:24PM (#29776620)

I would love to read an in depth breakdown of an exploit using eBPF as part of its execution chain. Do you happen to have an example/link?

[ Parent | on HN ]

Re:Notes on BPF and eBPF by stefan_ on Sunday January 02, 2022 @10:23PM (#29776980)

This was the one I was thinking of: https://googleprojectzero.blogspot.com/2020/

Scroll down to "The ultimate ROP"

[ Parent | on HN ]