Vulnerability · Published Mar 9, 2021 · Assigned by redhat

CVE-2021-20268

High 7.8

In plain English

A high-severity improper input validation in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High

Exploit odds (30 days)0.3%top 74.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	linux	5.10.12-1	DEBIAN-CVE-2021-20268
Debian:13	linux	5.10.12-1	DEBIAN-CVE-2021-20268
Debian:14	linux	5.10.12-1	DEBIAN-CVE-2021-20268

Affected products (as reported)

Vendor	Product	Versions
n/a	kernel	kernel 5.10.10

Weakness: CWE-20

References

https://bugzilla.redhat.com/show_bug.cgi?id=1923816 x_refsource_MISC
https://lore.kernel.org/bpf/CACAyw99bEYWJCSGqfLiJ9Jp5YE1ZsZSiJxb4RFUTwbofipf0dA%40mail.gmail.com/T/#m8929643e99bea9c18ed490a7bc2591145eac6444 x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210409-0006/ x_refsource_CONFIRM