PT-2021-3369 · Linux+7 · Linux Kernel+7
Benedict Schlueter
+1
·
Published
2021-04-30
·
Updated
2023-05-17
·
CVE-2021-31829
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 5.12.1
Description
The issue is related to the Linux kernel's BPF subsystem, which has weaknesses in its authorization mechanism. This can allow an attacker to gain unauthorized access to protected information. Specifically, the kernel/bpf/verifier.c in the Linux kernel performs undesirable speculative loads, leading to the disclosure of stack content via side-channel attacks. The BPF stack area is not protected against speculative loads, and it can contain uninitialized data that might represent sensitive information previously operated on by the kernel.
Recommendations
For Linux kernel versions through 5.12.1, consider updating to a version that addresses the issue with speculative loads in the BPF subsystem to prevent unauthorized access to sensitive information.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Incorrect Authorization
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Ubuntu