CVE-2021-3600: Divide by Zero
First published: Wed Jun 23 2021(Updated: )
A flaw was found in the Linux kernel’s eBPF verification code, where the eBPF 32-bit div/mod source register truncation could lead to out-of-bounds reads and writes. By default, accessing the eBPF verifier is only possible to privileged users with CAP_SYS_ADMIN. This flaw allows a local user who can run eBPF instructions to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Credit: security@ubuntu.com security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-348.rt7.130.el8 | 0:4.18.0-348.rt7.130.el8 |
| redhat/kernel | <0:4.18.0-348.el8 | 0:4.18.0-348.el8 |
| redhat/Kernel | <5.11 | 5.11 |
| Linux Linux kernel | >=4.14.115<4.14.308 | |
| Linux Linux kernel | >=4.15<4.19.206 | |
| Linux Linux kernel | >=4.20<5.4.98 | |
| Linux Linux kernel | >=5.5<5.10.16 | |
| Linux Linux kernel | =5.11-rc1 | |
| Linux Linux kernel | =5.11-rc2 | |
| Linux Linux kernel | =5.11-rc3 | |
| Linux Linux kernel | =5.11-rc4 | |
| Linux Linux kernel | =5.11-rc5 | |
| Linux Linux kernel | =5.11-rc6 | |
| Linux Linux kernel | =5.11-rc7 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Fedoraproject Fedora | =34 | |
| Redhat Enterprise Linux | =8.0 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.12.5-1 6.12.6-1 | |
| >=4.14.115<4.14.308 | ||
| >=4.15<4.19.206 | ||
| >=4.20<5.4.98 | ||
| >=5.5<5.10.16 | ||
| =5.11-rc1 | ||
| =5.11-rc2 | ||
| =5.11-rc3 | ||
| =5.11-rc4 | ||
| =5.11-rc5 | ||
| =5.11-rc6 | ||
| =5.11-rc7 | ||
| =14.04 | ||
| =16.04 | ||
| =18.04 | ||
| =34 | ||
| =8.0 |
Remedy
The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled. For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw. A kernel update will be required to mitigate the flaw for the root or users with CAP_SYS_ADMIN capabilities.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-3600 https://nvd.nist.gov/vuln/detail/CVE-2021-3600 https://lore.kernel.org/patchwork/patch/1379497/ https://www.openwall.com/lists/oss-security/2021/06/23/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1981954
- https://access.redhat.com/errata/RHSA-2021:4140
- https://access.redhat.com/errata/RHSA-2021:4356
- https://access.redhat.com/security/cve/cve-2021-3600
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3600
- https://git.kernel.org/linus/e88b2c6e5a4d9ce30d75391e4d950da74bb2bd90
- https://ubuntu.com/security/notices/USN-5003-1
- https://launchpad.net/bugs/cve/CVE-2021-3600
- https://www.openwall.com/lists/oss-security/2021/06/23/1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1981955
- https://security-tracker.debian.org/tracker/CVE-2021-3600
- https://nvd.nist.gov/vuln/detail/CVE-2021-3600
- https://ubuntu.com/security/CVE-2021-3600
- collector/redhat-cve
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- agent/author
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3600
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/nvd-cve
- agent/remedy
- agent/references
- agent/first-publish-date
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/4.14.115
- version/linux linux kernel/4.15
- version/linux linux kernel/4.20
- version/linux linux kernel/5.5
- version/linux linux kernel/5.11-rc1
- version/linux linux kernel/5.11-rc2
- version/linux linux kernel/5.11-rc3
- version/linux linux kernel/5.11-rc4
- version/linux linux kernel/5.11-rc5
- version/linux linux kernel/5.11-rc6
- version/linux linux kernel/5.11-rc7
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- package-manager/debian