CVE-2021-47607: bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
First published: Wed Jun 19 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg The implementation of BPF_CMPXCHG on a high level has the following parameters: .-[old-val] .-[new-val] BPF_R0 = cmpxchg{32,64}(DST_REG + insn->off, BPF_R0, SRC_REG) `-[mem-loc] `-[old-val] Given a BPF insn can only have two registers (dst, src), the R0 is fixed and used as an auxilliary register for input (old value) as well as output (returning old value from memory location). While the verifier performs a number of safety checks, it misses to reject unprivileged programs where R0 contains a pointer as old value. Through brute-forcing it takes about ~16sec on my machine to leak a kernel pointer with BPF_CMPXCHG. The PoC is basically probing for kernel addresses by storing the guessed address into the map slot as a scalar, and using the map value pointer as R0 while SRC_REG has a canary value to detect a matching address. Fix it by checking R0 for pointers, and reject if that's the case for unprivileged programs.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux kernel | >=5.12<5.15.11 | |
| Linux kernel | =5.16-rc1 | |
| Linux kernel | =5.16-rc2 | |
| Linux kernel | =5.16-rc3 | |
| Linux kernel | =5.16-rc4 | |
| Linux kernel | =5.16-rc5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-47607?
CVE-2021-47607 is classified with a moderate severity due to potential information leakage in the Linux kernel.
How do I fix CVE-2021-47607?
To fix CVE-2021-47607, upgrade to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2021-47607?
CVE-2021-47607 affects Linux kernel versions prior to 5.15.12 and specific release candidates of 5.16.
What does CVE-2021-47607 exploit in the Linux kernel?
CVE-2021-47607 exploits a kernel address leakage through the BPF_CMPXCHG operation in the Linux kernel.
Is CVE-2021-47607 available for public exploitation?
There is currently no public evidence to suggest that CVE-2021-47607 is being actively exploited in the wild.
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- agent/remedy
- agent/softwarecombine
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.12
- version/linux kernel/5.16-rc1
- version/linux kernel/5.16-rc2
- version/linux kernel/5.16-rc3
- version/linux kernel/5.16-rc4
- version/linux kernel/5.16-rc5