CVE-2021-3489: Linux kernel eBPF RINGBUF map oversized allocation
A flaw out of bound memory write in the Linux kernel BPF subsystem was found in the way user writes to BPF ring buffer too fast, so larger buffer than available memory could be allocated. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Other sources
The eBPF RINGBUF bpfringbufreserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).
This vulnerability allows local attackers to escalate privileges on affected installations of Canonical Ubuntu. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.13 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.95-1Fixed in 7.1.3-1Fixed in 7.1.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 4b81ccebaeee885ab1aa1438133f2991e3a2b6ea - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch v5.12.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch v5.11.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch v5.10.37 - Configuration
Set kernel.unprivileged_bpf_disabled=1 to disable eBPF for unprivileged users, mitigating the flaw (relevant because the attack requires unprivileged eBPF execution).
Linux kernel sysctl kernel.unprivileged_bpf_disabled = 1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3489?
CVE-2021-3489 is considered a high severity vulnerability due to its potential to allow local users to crash the system or escalate privileges.
How do I fix CVE-2021-3489?
To remediate CVE-2021-3489, update the affected Linux kernel to version 4.18.0-348.rt7.130.el8, 4.18.0-348.el8, or 5.13 and above as recommended.
What affected systems are impacted by CVE-2021-3489?
CVE-2021-3489 affects various versions of the Linux kernel, particularly versions between 4.18 and 5.13.
Can CVE-2021-3489 be exploited remotely?
CVE-2021-3489 requires local access for exploitation, making it a local privilege escalation vulnerability rather than a remote one.
What are the possible impacts of CVE-2021-3489?
The impacts of CVE-2021-3489 include system crashes and potential privilege escalation for local users.