CVE-2021-3444: Linux kernel bpf verifier incorrect mod32 truncation
Last updated 11 April 2025
Other sources
The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 9b00f1b78809 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.11.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.10.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.4.101
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3444?
CVE-2021-3444 is considered to have a high severity due to its potential for exploitation leading to out-of-bounds reads in kernel memory.
How do I fix CVE-2021-3444?
To fix CVE-2021-3444, you should upgrade to the patched versions of the Linux kernel as specified by your distribution.
Which Linux kernel versions are affected by CVE-2021-3444?
CVE-2021-3444 affects kernel versions prior to 5.10.19, and also between 5.11 and 5.11.2.
Can an attacker exploit CVE-2021-3444 remotely?
CVE-2021-3444 requires a local attacker with the ability to load BPF programs, therefore it is not a remote exploit.
What are the possible impacts of CVE-2021-3444 if exploited?
The exploitation of CVE-2021-3444 can lead to unauthorized access to kernel memory, which may expose sensitive information or lead to further system compromises.