CVE-2021-3444: Linux kernel bpf verifier incorrect mod32 truncation

Vulnerability summary

CVE-2021-3444 is a high (CVSS 7.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 49.2% of scored vulnerabilities.

Timeline

1. 23-03-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.

• CWE-681Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.