Riskcovery

CVE-2021-3489

Linux kernel eBPF RINGBUF map oversized allocation

State
Published
Severity
7.8 High
Published
Jun 4, 2021
Updated
Sep 16, 2024
Reserved
Apr 9, 2021

Read the record on cve.org

Description

The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hcanonical

Weaknesses

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-787 Out-of-bounds Write

Affected Products

ProductVersions
Linux kernelLinux
  • trunk to before v5.13-rc4Affected
  • linux-5.12.y to before v5.12.4Affected
  • linux-5.11.y to before v5.11.21Affected
  • linux-5.10.y to before v5.10.37Affected
  • v5.8 to before 5.8*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.