Executive brief
Prevail is an eBPF program verifier that validates kernel-mode bytecode before execution. A verifier flaw allows specially crafted eBPF programs to bypass memory-access bounds checks and potentially corrupt kernel memory, even though the verifier incorrectly approves them as safe. This could enable privilege escalation or denial-of-service attacks on systems relying on Prevail for eBPF safety validation.
Technical details
The vulnerability is a logic error in the EbpfTransformer::add() function of the Prevail verifier. When a destination register holds a non-singleton typeset (multiple possible pointer types simultaneously), the function silently fails to update the offset-variable state. Subsequent bounds-checking logic then consumes the stale offset value, allowing out-of-bounds memory accesses to pass verification. An attacker crafts an eBPF program that exploits this condition to construct out-of-bounds pointers that would cause memory corruption at runtime. The fix, released in version 0.2.4, applies "havoc" semantics (invalidates offsets) when pointer arithmetic occurs on non-singleton typesets, ensuring safe verification.
Affected products
- vBPF Prevail prior to 0.2.4
Timeline
- 2026-09-02: disclosed
- 2026-06-01: patched: Version 0.2.4 released