CVE-2021-20239: Buffer Overflow
A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality.
Other sources
A flaw was found in the Linux kernels implementation of BPF. A local user with CAPNETADMIN can attach an ebpf filter to setsockopt() syscall. This filter can be triggered under the right conditions to leak kernel internal information. This could allow an attacker to determine the layout of information in kernel memory to be used in future attacks.
This flaw is also known as ZDI-21-100.
References:
https://www.zerodayinitiative.com/advisories/ZDI-21-100/ https://gist.github.com/Ga-ryo/2ec958e78f55c5d18558960f3fe1c6ec
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-20239?
The severity of CVE-2021-20239 is high due to its potential impact on confidentiality.
How do I fix CVE-2021-20239?
To fix CVE-2021-20239, you need to upgrade to Linux kernel version 5.4.92 or later.
Who is affected by CVE-2021-20239?
CVE-2021-20239 affects Linux kernel versions prior to 5.4.92, impacting systems using Red Hat Enterprise Linux and Fedora.
What type of attack can exploit CVE-2021-20239?
CVE-2021-20239 can be exploited by an attacker with local access, allowing them to leak internal kernel addresses.
Is CVE-2021-20239 patched in all distributions?
CVE-2021-20239 has been patched in several distributions, but users should verify their specific distribution for an available update.