Log in Start free

Vulnerability · Published Jun 4, 2021 · Assigned by canonical

CVE-2021-3490Linux kernel eBPF bitwise ops ALU32 bounds tracking

High 7.8

In plain English

A high-severity out-of-bounds write in Linux kernel from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 27.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)27.4%top 1.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Metasploit, Public PoC

Official description

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.10.38-1DEBIAN-CVE-2021-3490
Debian:13linux5.10.38-1DEBIAN-CVE-2021-3490
Debian:14linux5.10.38-1DEBIAN-CVE-2021-3490

Affected products (as reported)

VendorProductVersions
Linux Linux kernel trunk – before v5.13-rc4linux-5.12.y – before v5.12.4linux-5.11.y – before v5.11.21linux-5.10.y – before v5.10.37v5.7-rc1 – before 5.7*

Weakness: CWE-787, CWE-20 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References