PT-2021-22022 · Linux+1 · Linux Kernel+1

Piotr Krysiuk · Published 2021-09-20 · Updated 2023-08-14 · CVE-2021-38300

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.4.10

Description: The issue in the Linux kernel allows for the generation of undesirable machine code when transforming unprivileged cBPF programs, enabling the execution of arbitrary code within the kernel context. This occurs due to conditional branches exceeding the 128 KB limit of the MIPS architecture.

Recommendations: For Linux kernel versions prior to 5.4.10, update to version 5.4.10 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Exploit

Fix

Related Identifiers

ALT-PU-2021-2989

ALT-PU-2021-2996

ALT-PU-2021-2998

ALT-PU-2021-3015

ALT-PU-2021-3021

ALT-PU-2021-3022

ALT-PU-2021-3035

ALT-PU-2021-3055

ALT-PU-2021-3067

ALT-PU-2021-3070

ALT-PU-2021-3451

ALT-PU-2021-3458

ALT-PU-2021-3468

ALT-PU-2021-3477

ALT-PU-2021-3563

ALT-PU-2021-3573

ALT-PU-2022-2096

ALT-PU-2023-4894

AZL-6594

CVE-2021-38300

DLA-2941-1

DSA-5096-1

OESA-2021-1379

Affected Products

Alt Linux

Linux Kernel

References · 29

• 🔥 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38300 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2941-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38300 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-3669 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-38300 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20317 · Security Note
• https://ubuntu.com/security/CVE-2021-38300 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42008 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38300 · Vendor Advisory
• https://debian.org/security/2022/dsa-5096 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41864 · Security Note