Re: Backports available - cBPF JIT spray hardening

[Jose R Rodriguez <jose.r.r () metztli com>]

On 2026-07-30 07:00, Greg KH wrote:
> On Wed, Jul 29, 2026 at 06:31:11PM -0700, Pawan Gupta wrote:
> > On Wed, Jul 29, 2026 at 05:15:46PM -0700, Jose R Rodriguez wrote:
> > > On 2026-07-29 13:04, Pawan Gupta wrote:
> > > > Hi All,
> > > >
> > > > This is an inform distro maintainers about recently upstreamed hardening
> > > > against speculative execution attacks using BPF JIT spraying.
> > > >
> > > > The backports are available here:
> > > >
> > > >   6.1  - https://lore.kernel.org/all/20260727-cbpf-jit-spray-hardening-6-1-y-v1-0-eb80dcf1eb6e () linux intel com
> > > >   6.6  - https://lore.kernel.org/all/20260717-cbpf-jit-spray-hardening-6-6-y-v1-0-e04f1b2893de () linux intel com
> > > >   6.12 - https://lore.kernel.org/all/20260715-cbpf-jit-spray-hardening-6-12-y-v1-0-d8585a9aed80 () linux intel com
> > > >   6.18 - https://lore.kernel.org/all/20260713-cbpf-jit-spray-hardening-6-18-y-v1-0-755f60c55705 () linux intel com
> > > >   7.1  - https://lore.kernel.org/all/20260709-cbpf-jit-spray-hardening-7-1-y-v1-0-5ac5a2d6797f () linux intel com
> > > >
> > > > 6.1 backport is queued. Others are part of LTS kernels.
> > > >
> > > > 5.15 and older do not support pack allocator for BPF on which the
> > > > hardening
> > > > is based on. So the series is not directly applicable to 5.15 and older,
> > > > and may need custom hardening patches.
> > >
> > > Any patches out there for kernel 5.17.15? Thanks in advance!
> >
> > Pack allocator was first introduced in 5.18 by commit:
> >
> >   57631054fae6 ("bpf: Introduce bpf_prog_pack allocator")
> >
> > This means that 5.17 is in the same boat as 5.15, it does not support 
> > BPF
> > pack allocator, and these hardening patches dont apply.
> >
> > Pack allocator makes the JIT spraying attacks easier, but this doesn't 
> > mean
> > that kernels withouth it are immune to such attacks. This needs a 
> > fresh
> > assessment and possibly a different hardening approach.
> >
> > BTW, I am confused by the choice of distro kernel 5.17 which is not an 
> > LTS
> > kernel.
>
> Yes, that's a very odd choice for anyone to run these days.  According
> to the cve tools:
>         Total Vulnerable CVE's in 5.17.15 : 7035
>
> That's a non-trivial amount...
>
> good luck!
>
> greg k-h

Your insight is appreciated, i.e., hint taken. Thank you!

--
Best Professional Regards.

--
Jose R R
http://metztli.it
---------------------------------------------------------------------------------------------
Download Metztli Reiser4: Debian Trixie w/ Linux 5.17.15-3 AMD64
---------------------------------------------------------------------------------------------
feats ZSTD compression https://sf.net/projects/metztli-reiser4/
-------------------------------------------------------------------------------------------
Official current Reiser4 resources: https://reiser4.wiki.kernel.org/