Seccomp denylist bypass via 32-bit syscall argument truncation
// AI summary
Ricardo Branco detailed a seccomp filter bypass affecting containerd, Podman, systemd, and QEMU due to a mismatch when 32-bit syscall arguments are truncated on 64-bit architectures.
// from the source
Posted by Ricardo Branco on Oct 27 Hello, I am writing to share details regarding a seccomp filter bypass pattern affecting several projects (including containerd, Podman, systemd, and QEMU) that rely on denylists for system call argument inspection. The issue stems from an evaluation mismatch between seccomp-bpf and the Linux kernel when 32-bit integer arguments are passed via 64-bit CPU registers on 64-bit architectures. Vulnerability Details ===================== Many...