PREVAIL vulnerabilities

In PREVAIL versions prior to 0.2.4, the eBPF verifier accepts ALU32 ADD and SUB instructions on pointer-typed registers without checking the is64 flag. ALU32 arithmetic zero-extends the result, destroying the upper half of the pointer at runtime, yet the program is marked safe. Any caller can submit a program that passes verification but faults at runtime. Patched in version 0.2.4.

In the PREVAIL eBPF verifier before version 0.2.4, the abstract transformer treats writes through a T_CTX-typed base register as a silent no-op. An attacker can craft an eBPF program that overwrites a context field, reloads it as T_PACKET, and dereferences an attacker-controlled address, and PREVAIL will report the program as safe.

In the PREVAIL eBPF verifier before version 0.2.4, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset. Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime.