CVE-2021-3489

Published Jun 4, 2021

Last updated 4 years ago

CVSS high 7.8

Overview

Description: The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).
Source: security@ubuntu.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 7.2
Impact score: 10
Exploitability score: 3.9
Vector string: AV:L/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

nvd@nist.gov: CWE-787
security@ubuntu.com: CWE-119

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CD2F1C00-3D81-452B-AE61-0B2C1A536A1D",
            "versionEndExcluding": "5.10.37",
            "versionStartIncluding": "5.8"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8CBB94EC-EC33-4464-99C5-03E5542715F0",
            "versionEndExcluding": "5.11.21",
            "versionStartIncluding": "5.11"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D8C7052F-1B7B-4327-9C2B-84EBF3243838",
            "versionEndExcluding": "5.12.4",
            "versionStartIncluding": "5.12"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8F0E7012-0BA3-4E6A-ADE9-57973CBDEE28"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "338B3AAC-C147-4A31-95E7-6E8A6FB4B3FC"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8EF1C1CC-3FAE-4DE3-BC41-E5B14D5721F4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References