CVE-2021-31440: Linux Kernel eBPF Improper Input Validation Privilege Escalation Vulnerability
An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking unsigned 32-bit instructions in an eBPF program occurs.. By default accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
External Reference:
https://www.zerodayinitiative.com/advisories/ZDI-21-503/
Upstream Fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=10bf4e83167cc68595b85fd73bb91e8f2c086e36
— Red Hat
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-13661.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.13 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Configuration
Set the sysctl kernel.unprivileged_bpf_disabled to 1 so that unprivileged users cannot use eBPF (mitigates the eBPF verifier improper input validation flaw).
Linux kernel (eBPF unprivileged access via sysctl) kernel.unprivileged_bpf_disabled = 1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-31440?
CVE-2021-31440 has a medium severity rating due to its potential impact on the Linux kernel's eBPF code verifier.
How do I fix CVE-2021-31440?
To fix CVE-2021-31440, ensure you upgrade to the recommended kernel versions for your distribution.
What systems are affected by CVE-2021-31440?
CVE-2021-31440 affects various Linux kernel versions including 4.18, 5.10, and 5.13, along with specific Red Hat kernel packages.
What is the nature of the vulnerability in CVE-2021-31440?
CVE-2021-31440 is an out-of-bounds access flaw in the eBPF code verifier caused by incorrect register bounds calculation.
Is CVE-2021-31440 exploitable?
Yes, CVE-2021-31440 can be exploited by crafting malicious eBPF programs that leverage the vulnerability.