eBPF Rootkits Gain Traction Among Underground Actors as Emerging Linux Threats
Extended Berkeley Packet Filter (eBPF) technology in the Linux kernel, originally designed for legitimate uses like network monitoring and security, is increasingly weaponized by attackers to create stealthy rootkits. Unlike traditional rootkits relying on loadable kernel modules, eBPF-based malware operates via legitimate kernel interfaces, bypassing common detection methods such as lsmod or existing EDR solutions. Recent research by Flare reveals underground forums sharing eBPF rootkit source code and detailed tutorials, including capabilities like process hiding, packet-triggered activation, and encrypted command-and-control communications. Notable instances of eBPF-based threats include BPFDoor, Symbiote, and LinkPro, with weaponized exploits targeting kernel vulnerabilities like CVE-2017-16995. Defensive measures recommended focus on auditing loaded eBPF programs, restricting eBPF access, monitoring for suspicious network packet triggers, and patching kernel vulnerabilities promptly. As eBPF rootkits evolve to evade traditional detection tools, organizations running Linux infrastructure should elevate their threat models to account for this novel attack vector.
Entenda a falha
A vulnerabilidade
CVE-2017-16995 is a 2017 flaw in the Linux kernel's BPF verifier, the component that checks eBPF programs before they are loaded. The articles describe it as an incorrect sign extension bug. They do not give the attacker's prerequisites, the affected versions or the fixed versions. Flare says it is the most frequently reposted eBPF exploit in its underground dataset, so it is old but still actively circulated. The story is mainly about eBPF rootkits, and this CVE is the example of a weaponized kernel exploit.
Como funciona
When a program is loaded through the bpf() interface, the kernel's verifier analyzes it and decides whether it is safe to run inside the kernel. A program that passes is treated like any other approved one. In this bug the verifier mishandles a sign extension while analyzing the program. The articles give no further detail on how the verifier's view of the program then diverges from what actually runs.
Por que é vulnerável
The articles attribute the flaw to incorrect sign extension in the BPF verifier. They add that BPF verifier bugs are a recurring vulnerability class and that weaponized exploits appear fast. They do not describe the fix; the general advice is to patch kernels promptly.
Como foi descoberta
The articles do not say how CVE-2017-16995 was originally found; they only say it dates from 2017. It came up in Flare's recent research into underground forums, which found exploit code for it reposted on at least six platforms.
PoC pública
Flare found exploit code for CVE-2017-16995 circulating openly across at least six platforms, and it is the most frequently reposted exploit in its dataset. The articles do not say what it was tested against or how reliable it is. Because the code is widely available, unpatched older kernels should be treated as urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 14:15.
3 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2017-16995. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Linux - BPF Sign Extension Local Privilege Escalation (Metasploit)
This is a Metasploit module for CVE-2017-16995, a sign-extension flaw in the Linux kernel's BPF verifier (before 4.14.8). A local attacker who already has a shell or Meterpreter session as an unprivileged user can load BPF programs and gain root. It needs x86_64, a kernel roughly 4.0 to 4.14.11, and unprivileged BPF not disabled. The module checks these conditions, drops a C exploit (compiled on target with gcc, or precompiled) plus a payload into a writable directory, runs it and cleans up. It is a mature, working exploit, tested on many distributions.
-
Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation
This is a working local privilege escalation for CVE-2017-16995, a flaw in the Linux kernel's eBPF verifier reached through the bpf() system call. The attacker needs only an unprivileged local account on a vulnerable kernel (before 4.13.9, such as Ubuntu 16.04 or Fedora 27) with unprivileged eBPF enabled; no network access or user interaction is required. The program slips a malicious filter past the verifier, which gives it arbitrary kernel memory read and write. It then locates its own process credentials and overwrites them to become root, opening a root shell. The author reports successful tests on several kernel versions, so it is mature and reliable.
-
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation
This local exploit abuses a flaw in the Linux kernel's eBPF verifier (CVE-2017-16995), reached through the bpf system call. A crafted socket-filter program gets past the checks and gives the attacker arbitrary kernel memory read and write. It needs only an unprivileged local account on a vulnerable kernel with unprivileged BPF enabled, as on Ubuntu 16.04. It locates the process credentials and zeroes the user and group IDs, then starts a root shell. It looks like a working exploit, but offsets are hardcoded for kernel 4.4.0-116 and need adjusting for other builds.
Linha do tempo
-
eBPF Rootkits Gain Traction Among Underground Actors as Emerging Linux Threats
ler a análise desta fonte ocultar
Extended Berkeley Packet Filter (eBPF) technology in the Linux kernel, originally designed for legitimate uses like network monitoring and security, is increasingly weaponized by attackers to create stealthy rootkits. Unlike traditional rootkits relying on loadable kernel modules, eBPF-based malware operates via legitimate kernel interfaces, bypassing common detection methods such as lsmod or existing EDR solutions. Recent research by Flare reveals underground forums sharing eBPF rootkit source code and detailed tutorials, including capabilities like process hiding, packet-triggered activation, and encrypted command-and-control communications. Notable instances of eBPF-based threats include BPFDoor, Symbiote, and LinkPro, with weaponized exploits targeting kernel vulnerabilities like CVE-2017-16995. Defensive measures recommended focus on auditing loaded eBPF programs, restricting eBPF access, monitoring for suspicious network packet triggers, and patching kernel vulnerabilities promptly. As eBPF rootkits evolve to evade traditional detection tools, organizations running Linux infrastructure should elevate their threat models to account for this novel attack vector.