CVE-2021-3489: (Pwn2Own) Canonical Ubuntu eBPF Out-Of-Bounds Access Privilege Escalation Vulnerability
First published: Tue May 11 2021(Updated: )
A flaw out of bound memory write in the Linux kernel BPF subsystem was found in the way user writes to BPF ring buffer too fast, so larger buffer than available memory could be allocated. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Credit: security@ubuntu.com security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-348.rt7.130.el8 | 0:4.18.0-348.rt7.130.el8 |
| redhat/kernel | <0:4.18.0-348.el8 | 0:4.18.0-348.el8 |
| Linux Linux kernel | >=5.8<5.10.37 | |
| Linux Linux kernel | >=5.11<5.11.21 | |
| Linux Linux kernel | >=5.12<5.12.4 | |
| Linux Linux kernel | =5.13 | |
| Linux Linux kernel | =5.13-rc1 | |
| Linux Linux kernel | =5.13-rc2 | |
| Linux Linux kernel | =5.13-rc3 | |
| Canonical Ubuntu Linux | =20.04 | |
| Canonical Ubuntu Linux | =20.10 | |
| Canonical Ubuntu Linux | =21.04 | |
| Canonical Ubuntu | ||
| redhat/kernel | <5.13 | 5.13 |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.11.10-1 6.12.5-1 |
Remedy
The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled. For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw. A kernel update will be required to mitigate the flaw for the root or users with CAP_SYS_ADMIN capabilities.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-3489 https://nvd.nist.gov/vuln/detail/CVE-2021-3489 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=4b81ccebaeee885ab1aa1438133f2991e3a2b6ea https://www.openwall.com/lists/oss-security/2021/05/11/10
- https://bugzilla.redhat.com/show_bug.cgi?id=1959559
- https://access.redhat.com/errata/RHSA-2021:4140
- https://access.redhat.com/errata/RHSA-2021:4356
- https://access.redhat.com/security/cve/cve-2021-3489
- https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=4b81ccebaeee885ab1aa1438133f2991e3a2b6ea
- https://security.netapp.com/advisory/ntap-20210716-0004/
- https://ubuntu.com/security/notices/USN-4949-1
- https://ubuntu.com/security/notices/USN-4950-1
- https://www.openwall.com/lists/oss-security/2021/05/11/10
- https://www.zerodayinitiative.com/advisories/ZDI-21-590/
- https://launchpad.net/bugs/cve/CVE-2021-3489
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1959561
- https://security-tracker.debian.org/tracker/CVE-2021-3489
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3489
- https://nvd.nist.gov/vuln/detail/CVE-2021-3489
- https://ubuntu.com/security/CVE-2021-3489
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/title
- agent/weakness
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-590
- alias/ZDI-CAN-13586
- alias/CVE-2021-3489
- agent/software-canonical-lookup
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/5.8
- version/linux linux kernel/5.11
- version/linux linux kernel/5.12
- version/linux linux kernel/5.13
- version/linux linux kernel/5.13-rc1
- version/linux linux kernel/5.13-rc2
- version/linux linux kernel/5.13-rc3
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/20.04
- version/canonical ubuntu linux/20.10
- version/canonical ubuntu linux/21.04
- canonical/canonical ubuntu
- package-manager/debian