Linux Kernel up to 5.12.18/5.13.3 bpf memory corruption

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.12.18/5.13.3. It has been declared as critical. This affects an unknown function of the component bpf. Such manipulation leads to memory corruption. This vulnerability is referenced as CVE-2021-47317. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.12.18/5.13.3 and classified as critical. Affected by this issue is some unknown processing of the component bpf. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: powerpc/bpf: Fix detecting BPF atomic instructions Commit 91c960b0056672 ("bpf: Rename BPF_XADD and prepare to encode other atomics in .imm") converted BPF_XADD to BPF_ATOMIC and added a way to distinguish instructions based on the immediate field. Existing JIT implementations were updated to check for the immediate field and to reject programs utilizing anything more than BPF_ADD (such as BPF_FETCH) in the immediate field. However, the check added to powerpc64 JIT did not look at the correct BPF instruction. Due to this, such programs would be accepted and incorrectly JIT'ed resulting in soft lockups, as seen with the atomic bounds test. Fix this by looking at the correct immediate value.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2021-47317 since 05/21/2024. The exploitation is known to be easy. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/13/2025).

Upgrading to version 5.12.19 or 5.13.4 eliminates this vulnerability. Applying the patch 7284dab07e4d/0d435b6d94b0/419ac821766c is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3
• 5.12.4
• 5.12.5
• 5.12.6
• 5.12.7
• 5.12.8
• 5.12.9
• 5.12.10
• 5.12.11
• 5.12.12
• 5.12.13
• 5.12.14
• 5.12.15
• 5.12.16
• 5.12.17
• 5.12.18
• 5.13.0
• 5.13.1
• 5.13.2
• 5.13.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion