CVE-2021-20268

Published: 9 March 2021

An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

From the Ubuntu Security Team

It was discovered that the BPF verifier in the Linux kernel did not properly handle signed add32 and sub integer overflows. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Mitigation

If loading of BPF programs by unprivileged users is not needed, set the
following sysctl, or disable it permanently in /etc/sysctl.d/:
   kernel.unprivileged_bpf_disabled = 1

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20268
• https://www.zerodayinitiative.com/advisories/ZDI-21-101/
• https://git.kernel.org/linus/bc895e8b2a64e502fbba72748d59618272052a8b
• https://ubuntu.com/security/notices/USN-4910-1
• NVD
• Launchpad
• Debian