PT-2021-13832 · Linux+5 · Linux Kernel+5

Dhananjay Arunesh + 1 · Published 2021-01-22 · Updated 2023-02-12 · CVE-2021-20194

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: linux kernel versions higher than 5.2

Description: The issue arises from a vulnerability in the linux kernel when compiled with specific config parameters, including CONFIG BPF SYSCALL=y, CONFIG BPF=y, CONFIG CGROUPS=y, CONFIG CGROUP BPF=y, and CONFIG HARDENED USERCOPY not set, along with a registered BPF hook to getsockopt. This vulnerability allows a local user to trigger a bug in the cgroup bpf run filter getsockopt() function, potentially leading to a heap overflow due to non-hardened usercopy. The impact of the attack could result in denial of service or possibly privileges escalation.

Recommendations: For linux kernel versions higher than 5.2, consider disabling the BPF hook to getsockopt as a temporary workaround until a patch is available. Restrict access to the cgroup bpf run filter getsockopt() function to minimize the risk of exploitation. Avoid using the getsockopt API endpoint with BPF execution until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

RCE

Weakness Enumeration

CWE-787

CWE-20

Related Identifiers

ALSA-2021:4356

AZL-34857

AZL-6529

CESA-2021_4140

CESA-2021_4356

CVE-2021-20194

MGASA-2021-0099

MGASA-2021-0100

RHSA-2021:4140

RHSA-2021:4356

RHSA-2021_4140

RHSA-2021_4356

USN-4879-1

USN-4884-1

USN-4909-1

USN-4912-1

Affected Products

Almalinux

Centos

Linuxmint

Red Hat

Ubuntu

Linux Kernel

References · 104

• https://ubuntu.com/security/CVE-2020-14390 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29154 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25285 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4884-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20194 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20194 · Security Note
• https://ubuntu.com/security/CVE-2020-0465 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36158 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4879-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25669 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27830 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6529 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4356 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20194 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-0466 · Vendor Advisory