PT-2021-4226 · Linux+7 · Linux Kernel+7

Manfred Paul · Published 2021-04-23 · Updated 2023-08-11 · CVE-2021-31440

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel version 5.11.15

Description This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of eBPF programs, resulting from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the kernel.

Recommendations For Linux Kernel version 5.11.15, consider disabling the handling of eBPF programs as a temporary workaround until a patch is available. Restrict access to the eBPF subsystem to minimize the risk of exploitation. Avoid using the CAP SYS MODULE capability in containers to prevent attackers from loading arbitrary kernel modules. Implement seccomp to restrict system calls and reduce the attack surface.

Fix

Weakness Enumeration

CWE-682

Related Identifiers

ALSA-2021:4356

ALT-PU-2021-1707

BDU:2021-04830

CESA-2021_4140

CESA-2021_4356

CVE-2021-31440

MGASA-2021-0214

MGASA-2021-0215

RHSA-2021:4140

RHSA-2021:4356

RHSA-2021_4140

RHSA-2021_4356

SUSE-SU-2021:3360-1

SUSE-SU-2021_3360-1

USN-4997-1

USN-4997-2

USN-4999-1

USN-5001-1

ZDI-21-503

Affected Products

Alt Linux

Almalinux

Centos

Linux Kernel

Linuxmint

Red Hat

Suse

Ubuntu

References · 118

• https://advisories.mageia.org/MGASA-2021-0214.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-31440 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26139 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29155 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24587 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25670 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0215 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4999-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26145 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33200 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-503 · Security Note
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=10bf4e83167cc68595b85fd73bb91e8f2c086e36 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4356 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31440 · Security Note