cilium / tetragon

eBPF-based Security Observability and Runtime Enforcement
https://tetragon.io
Apache License 2.0
3.66k stars 369 forks source link

Backports/v1.2: tetragon: probe_read usage may cause issues with newer kernels #3105

Closed kevsecurity closed 1 week ago

kevsecurity commented 1 week ago

Newer kernels should not use probe_read so convert to probe_read_kernel. We have logic to revert to probe_read on older kernels. Further using probe_read instead of correct proberead{kernel|user} may fault on some architectures.

Changelog

Convert probe_read to probe_read_kernel.

Convert probe_read to probe_read_kernel to avoid possible runtime faults with probe_read on some architectures.

[Upstream PR: #2925]