Tracker / CVE-2021-3489
CVE-2021-3489
High 7.8
The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).
Affected products and versions
| canonical | ubuntu_linux |
|---|---|
| linux | linux_kernel |
| linux | linux_kernel · 5.11 → 5.11.21 |
| linux | linux_kernel · 5.12 → 5.12.4 |
| linux | linux_kernel · 5.8 → 5.10.37 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.