CVE-2021-3490
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 27.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 27.48% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20, CWE-787, CWE-125
- Affected
- linux/linux kernel · canonical/ubuntu linux
- Source
- security@ubuntu.com
References
- http://packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80ePatch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210716-0004/Third Party Advisory
- https://ubuntu.com/security/notices/USN-4949-1Third Party Advisory
- https://ubuntu.com/security/notices/USN-4950-1Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/05/11/11Mailing List, Patch, Third Party Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-606/Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80ePatch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210716-0004/Third Party Advisory
- https://ubuntu.com/security/notices/USN-4949-1Third Party Advisory
- https://ubuntu.com/security/notices/USN-4950-1Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/05/11/11Mailing List, Patch, Third Party Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-606/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.