Linux Kernel up to 5.12.1 bpf off_reg privilege escalation

Summaryinfo

A vulnerability described as problematic has been identified in Linux Kernel up to 5.12.1. Impacted is the function off_reg of the component bpf. The manipulation results in an unknown weakness. This vulnerability is reported as CVE-2021-46974. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.12.1 (Operating System). Affected is the function off_reg of the component bpf. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix masking negation logic upon negative dst register The negation logic for the case where the off_reg is sitting in the dst register is not correct given then we cannot just invert the add to a sub or vice versa. As a fix, perform the final bitwise and-op unconditionally into AX from the off_reg, then move the pointer from the src to dst and finally use AX as the source for the original pointer arithmetic operation such that the inversion yields a correct result. The single non-AX mov in between is possible given constant blinding is retaining it as it's not an immediate based operation.

The weakness was disclosed 02/27/2024. The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2021-46974. There are known technical details, but no exploit is available.

Upgrading to version 4.14.233, 4.19.190, 5.4.117, 5.10.35, 5.11.19, 5.12.2 or 5.13 eliminates this vulnerability. Applying the patch 4d542ddb88fb/0e2dfdc74a7f/53e0db429b37/2cfa537674cd/6eba92a4d4be/7cf64d8679ca/b9b34ddbe207 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.14.232
• 4.19.189
• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.4.116
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.10.0
• 5.10.1
• 5.10.2
• 5.10.3
• 5.10.4
• 5.10.5
• 5.10.6
• 5.10.7
• 5.10.8
• 5.10.9
• 5.10.10
• 5.10.11
• 5.10.12
• 5.10.13
• 5.10.14
• 5.10.15
• 5.10.16
• 5.10.17
• 5.10.18
• 5.10.19
• 5.10.20
• 5.10.21
• 5.10.22
• 5.10.23
• 5.10.24
• 5.10.25
• 5.10.26
• 5.10.27
• 5.10.28
• 5.10.29
• 5.10.30
• 5.10.31
• 5.10.32
• 5.10.33
• 5.10.34
• 5.11
• 5.11.0
• 5.11.1
• 5.11.2
• 5.11.3
• 5.11.4
• 5.11.5
• 5.11.6
• 5.11.7
• 5.11.8
• 5.11.9
• 5.11.10
• 5.11.11
• 5.11.12
• 5.11.13
• 5.11.14
• 5.11.15
• 5.11.16
• 5.11.17
• 5.11.18
• 5.12
• 5.12.0
• 5.12.1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion