CVE-2021-33200: Buffer Overflow
A flaw was found in kernel/bpf/verifier.c in BPF in the Linux kernel. An incorrect limit is enforced for pointer arithmetic operations which can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
In retrieveptrlimit and related functions of verifier.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
— OSV
kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alulimit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.13 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2021-12-05 - Configuration
Set kernel.unprivileged_bpf_disabled to 1 to prevent unprivileged users from using eBPF; on Red Hat Enterprise Linux 8, inspect the sysctl to confirm its current state.
Linux kernel kernel.unprivileged_bpf_disabled = 1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-33200?
CVE-2021-33200 has a high severity level due to its potential for local privilege escalation through out-of-bounds memory access.
How do I fix CVE-2021-33200?
To fix CVE-2021-33200, update the Linux kernel to a version that addresses this vulnerability, such as kernel-rt 0:4.18.0-348.rt7.130.el8 or kernel 0:4.18.0-348.el8.
What types of systems are affected by CVE-2021-33200?
CVE-2021-33200 affects various versions of the Linux kernel, including specific Red Hat and Debian distributions.
Can CVE-2021-33200 be exploited remotely?
CVE-2021-33200 cannot be exploited remotely; it requires local access to the affected system.
What should I do if I'm running an affected version of the Linux kernel related to CVE-2021-33200?
If running an affected version, immediately plan to update to a secured version of the Linux kernel to mitigate the risk of privilege escalation.