PT-2021-4259 · Linux+7 · Linux Kernel+7

Reiji Watanabe · Published 2021-04-13 · Updated 2023-05-17 · CVE-2021-3501

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.12

Description A flaw was found in the Linux kernel related to the KVM API, where the value of internal.ndata is mapped to an array index. This index can be updated by a user process at any time, potentially leading to an out-of-bounds write. The highest threat from this issue is to data integrity and system availability. It is also associated with a buffer overflow in memory, which could allow an attacker to cause stack damage.

Recommendations For Linux kernel versions prior to 5.12, update to version 5.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the KVM API to minimize the risk of exploitation. Avoid using the internal.ndata variable in sensitive operations until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2021:2168

ALT-PU-2021-1833

ALT-PU-2021-1888

ALT-PU-2021-1896

ALT-PU-2021-1983

ALT-PU-2021-3481

ALT-PU-2022-1240

ALT-PU-2022-1419

ALT-PU-2022-1421

ALT-PU-2023-1814

AZL-6569

BDU:2021-04867

CESA-2021_2165

CESA-2021_2168

CESA-2021_2169

CVE-2021-3501

RHSA-2021:2165

RHSA-2021:2168

RHSA-2021:2169

RHSA-2021:2522

RHSA-2021_2168

RHSA-2021_2169

RLSA-2021:2168

USN-4977-1

USN-4983-1

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Linux Kernel

Red Hat

Rocky Linux

Ubuntu

References · 107

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2022_0847_dirtypipe.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb · Exploit
• 🔥 https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit · Exploit
• 🔥 https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits · Exploit
• 🔥 https://github.com/tr3ee/CVE-2022-23222 · Exploit
• 🔥 https://github.com/Crusaders-of-Rust/CVE-2022-0185 · Exploit
• 🔥 https://github.com/chompie1337/Linux_LPE_eBPF_CVE-2021-3490 · Exploit
• 🔥 https://github.com/r1is/CVE-2022-0847 · Exploit
• 🔥 https://github.com/imfiver/CVE-2022-0847 · Exploit
• 🔥 https://github.com/plummm/CVE-2022-27666 · Exploit
• 🔥 https://github.com/pqlx/CVE-2022-1015 · Exploit
• 🔥 https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md · Exploit
• 🔥 https://github.com/Al1ex/CVE-2022-0847 · Exploit