Seccomp denylist bypass via 32-bit argument truncation
Original title: Seccomp denylist bypass via 32-bit syscall argument truncation
Ricardo Branco says containerd, Podman, systemd and QEMU denylists can misread 32-bit arguments in 64-bit registers.
Ricardo Branco posted to oss-security on October 27 about a seccomp filter bypass pattern affecting projects that use denylists to inspect system-call arguments, including containerd, Podman, systemd and QEMU. The issue is an evaluation mismatch between seccomp-bpf and the Linux kernel when 32-bit integer arguments are passed in 64-bit CPU registers on 64-bit architectures. The feed text is cut off before full vulnerability details, affected versions or fixes.
Unconfirmed: The snippet does not state fixed versions, a complete project list, or whether the bypass is exploited.
- Posted by Ricardo Branco on October 27.
- Named projects include containerd, Podman, systemd and QEMU.
- Mismatch is between seccomp-bpf checks and kernel handling of truncated 32-bit arguments.
- The snippet says the pattern affects several projects that rely on argument denylists.
Impact: Seccomp argument denylists can be bypassed
| Product | Affected |
|---|---|
| containerd | — |
| Podman | — |
| systemd | — |
| QEMU | — |
From the original article
Posted by Ricardo Branco on Oct 27 Hello, I am writing to share details regarding a seccomp filter bypass pattern affecting several projects (including containerd, Podman, systemd, and QEMU) that rely on denylists for system call argument inspection.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.