Log in Start free

Vulnerability · Published Jun 4, 2021 · Assigned by canonical

CVE-2021-3489Linux kernel eBPF RINGBUF map oversized allocation

High 7.8

In plain English

A high-severity memory corruption in Linux kernel from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.5%top 53.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8kernel-tools-libs-devel4.18.0-348.el8ALSA-2021:4356
Debian:12linux5.10.38-1DEBIAN-CVE-2021-3489
Debian:13linux5.10.38-1DEBIAN-CVE-2021-3489
Debian:14linux5.10.38-1DEBIAN-CVE-2021-3489

Affected products (as reported)

VendorProductVersions
Linux Linux kernel trunk – before v5.13-rc4linux-5.12.y – before v5.12.4linux-5.11.y – before v5.11.21linux-5.10.y – before v5.10.37v5.8 – before 5.8*

Weakness: CWE-119, CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References