CVE-2021-33200: High severity linux kernel vulnerability
A flaw was found in kernel/bpf/verifier.c in BPF in the Linux kernel. An incorrect limit is enforced for pointer arithmetic operations which can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alulimit.
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-33200?
CVE-2021-33200 has a high severity level due to its potential for local privilege escalation through out-of-bounds memory access.
How do I fix CVE-2021-33200?
To fix CVE-2021-33200, update the Linux kernel to a version that addresses this vulnerability, such as kernel-rt 0:4.18.0-348.rt7.130.el8 or kernel 0:4.18.0-348.el8.
What types of systems are affected by CVE-2021-33200?
CVE-2021-33200 affects various versions of the Linux kernel, including specific Red Hat and Debian distributions.
Can CVE-2021-33200 be exploited remotely?
CVE-2021-33200 cannot be exploited remotely; it requires local access to the affected system.
What should I do if I'm running an affected version of the Linux kernel related to CVE-2021-33200?
If running an affected version, immediately plan to update to a secured version of the Linux kernel to mitigate the risk of privilege escalation.