← CVE Intelligence

CVE-2021-3490

Linux kernel eBPF bitwise ops ALU32 bounds tracking PUBLISHED

Description (CNA)

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).

Affected (CNA)

Vendor / productVersions
Linux / Linux kernelaffected trunk before v5.13-rc4; affected linux-5.12.y before v5.12.4; affected linux-5.11.y before v5.11.21; affected linux-5.10.y before v5.10.37; affected v5.7-rc1 before 5.7*

CWE

CWE-787, CWE-20

References

ADP enrichment

CVE

No English description supplied.