CVE-2021-3444

Published: 23 March 2021

The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.

From the Ubuntu security team

De4dCr0w of 360 Alpha Lab discovered that the BPF verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker could use this to expose sensitive information (kernel memory) or possibly execute arbitrary code.

Priority

High

CVSS 3 base score: 7.8

Status

Notes

both f6b1b3bf0d5f681631a293cfe1ca934b81716f1e and
468f6eafa6c4 are needed for a system to be vulnerable.
e88b2c6e5a4d9ce30d75391e4d950da74bb2bd90 is likely needed as
a prerequisite fix as well

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3444
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9b00f1b78809309163dda2d044d9e94a3c0248a3
• https://www.openwall.com/lists/oss-security/2021/03/23/2
• https://ubuntu.com/security/notices/USN-4887-1
• NVD
• Launchpad
• Debian

Bugs