Log in Start free

Vulnerability · Published Mar 23, 2021 · Assigned by canonical

CVE-2021-3444Linux kernel bpf verifier incorrect mod32 truncation

High 7.8

In plain English

A high-severity security flaw in kernel from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.10.19-1DEBIAN-CVE-2021-3444
Debian:13linux5.10.19-1DEBIAN-CVE-2021-3444
Debian:14linux5.10.19-1DEBIAN-CVE-2021-3444
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-3444
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-3444
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-3444

Affected products (as reported)

VendorProductVersions
Linux kernel trunk – before 5.12-rc15.11 – before 5.11.25.10 – before 5.10.195.4 – before 5.4.101

Weakness: CWE-681 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References