CVE-2021-31440: Linux Kernel eBPF Improper Input Validation Privilege Escalation Vulnerability
An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking unsigned 32-bit instructions in an eBPF program occurs.. By default accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Other sources
In regcombine64into32 of verifier.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
— OSV
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
External Reference:
https://www.zerodayinitiative.com/advisories/ZDI-21-503/
Upstream Fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=10bf4e83167cc68595b85fd73bb91e8f2c086e36
— Red Hat
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-13661.
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.13 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2022-06-05 - Configuration
Set kernel.unprivileged_bpf_disabled to 1 to prevent unprivileged users from using eBPF and mitigate the flaw.
Linux kernel eBPF kernel.unprivileged_bpf_disabled = 1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-31440?
CVE-2021-31440 has a medium severity rating due to its potential impact on the Linux kernel's eBPF code verifier.
How do I fix CVE-2021-31440?
To fix CVE-2021-31440, ensure you upgrade to the recommended kernel versions for your distribution.
What systems are affected by CVE-2021-31440?
CVE-2021-31440 affects various Linux kernel versions including 4.18, 5.10, and 5.13, along with specific Red Hat kernel packages.
What is the nature of the vulnerability in CVE-2021-31440?
CVE-2021-31440 is an out-of-bounds access flaw in the eBPF code verifier caused by incorrect register bounds calculation.
Is CVE-2021-31440 exploitable?
Yes, CVE-2021-31440 can be exploited by crafting malicious eBPF programs that leverage the vulnerability.