CVE-2021-3490: Linux kernel eBPF bitwise ops ALU32 bounds tracking
In scalar32minmaxand and related functions of verifier.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Other sources
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.95-1Fixed in 7.1.3-1Fixed in 7.1.4-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2021-10-05 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in v5.13-rc4Patch 049c4e13714e
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3490?
CVE-2021-3490 is considered a high severity vulnerability due to its potential for arbitrary code execution in the Linux kernel.
How do I fix CVE-2021-3490?
To mitigate CVE-2021-3490, update your Linux kernel to a version that addresses this vulnerability, such as 5.10.223-1 or later.
Which Linux kernel versions are affected by CVE-2021-3490?
CVE-2021-3490 affects Linux kernel versions between 5.10 and 5.13, including specific release candidates.
What type of vulnerability is CVE-2021-3490 classified as?
CVE-2021-3490 is classified as a memory corruption vulnerability that stems from improper bounds tracking.
Can CVE-2021-3490 be exploited remotely?
CVE-2021-3490 requires local access to the system for exploitation, making it a local privilege escalation issue.