CVE-2021-3490: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2021-3490 is a high (CVSS 7.8) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 27.18% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 9Timeline
- 04-06-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
27.18%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
-0.30 pp
From 27.48% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Linux eBPF ALU32 32-bit Invalid Bounds Tracking LPE
exploit/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
Affected systems
Ubuntu16 products
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-azureAll versions (No fix recorded)
- linux-azure-5.3All versions (No fix recorded)
- linux-azure-edgeAll versions (No fix recorded)
Canonical1 product
- ubuntu_linuxEOL20.04 | 20.10 | 21.04
Debian1 product
- linux< 5.10.38-1
Linux1 product
- linux_kernelEOL≥ trunk, < v5.13-rc4 | ≥ linux-5.12.y, < v5.12.4 | ≥ linux-5.11.y, < v5.11.21 | ≥ linux-5.10.y, < v5.10.37 | ≥ v5.7-rc1, < 5.7* | ≥ 5.10, < 5.10.37 | ≥ 5.11, < 5.11.21 | ≥ 5.12, < 5.12.4 | 5.13 | 5.13:rc1 | 5.13:rc2 | 5.13:rc3
4 vendors · 19 products
References
11 links- www.openwall.com/lists/oss-security/2021/05/11/11Mailing ListX Refsource MLISTREPORTPatchThird Party Advisory
