CVE-2021-31829: Infoleak
A flaw was found in the Linux kernel's eBPF verification code. By default, accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. This flaw allows a local user who can insert eBPF instructions, to use the eBPF verifier to abuse a spectre-like flaw and infer all system memory. The highest threat from this vulnerability is to confidentiality.
Other sources
kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previously operated on by the kernel.
Programs inserted by privileged users can run Privileged BPF programs running on affected systems can bypass the protection and execute speculative loads from the kernel stack. This can be abused to extract contents of the stack via side-channel. The extracted contents may include addresses of kernel structures that could be used to defeat Kernel Address Space Layout Randomization (KASLR) to facilitate the exploitation of other vulnerabilities.
Reference: https://www.openwall.com/lists/oss-security/2021/05/04/4
Upstream patches: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=b9b34ddbe2076ade359cd5ce7537d5ed019e9807 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=801c6058d14a82179a7ee17a4b532cac6fad067f
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 801c6058d14a82179a7ee17a4b532cac6fad067f - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch b9b34ddbe2076ade359cd5ce7537d5ed019e9807 - Configuration
Set kernel.unprivileged_bpf_disabled to 1 to prevent unprivileged users from using eBPF.
Linux kernel kernel.unprivileged_bpf_disabled = 1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-31829?
CVE-2021-31829 is considered to have a high severity due to its potential impact on system security.
How do I fix CVE-2021-31829?
To fix CVE-2021-31829, update your kernel to versions 0:4.18.0-348.rt7.130.el8, 0:4.18.0-348.el8 for Red Hat, or apply the corresponding updates for your Linux distribution.
Which Linux distributions are affected by CVE-2021-31829?
CVE-2021-31829 affects various Linux distributions including Red Hat, Fedora versions 32, 33, 34, and Debian 9.0.
What kind of vulnerability is CVE-2021-31829?
CVE-2021-31829 is a local privilege escalation vulnerability related to eBPF verification in the Linux kernel.
Who can exploit CVE-2021-31829?
CVE-2021-31829 can be exploited by a local user with the ability to insert eBPF instructions to infer sensitive system information.