PT-2021-6102 · Linux+5 · Linux Kernel+5
Kuee K1R0A
·
Published
2021-12-16
·
Updated
2023-08-14
·
CVE-2021-45402
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to v5.16-rc5
Description
The issue is related to the
check alu op() function in kernel/bpf/verifier.c, which did not properly update bounds while handling the mov32 instruction. This allows local users to obtain potentially sensitive address information, also referred to as a "pointer leak." The vulnerability is associated with a buffer overflow in memory, which can be exploited to gain unauthorized access to protected information.Recommendations
For Linux kernel versions prior to v5.16-rc5, consider disabling the
check alu op() function as a temporary workaround until a patch is available. Restrict access to the kernel/bpf/verifier.c module to minimize the risk of exploitation. Avoid using the mov32 instruction in the affected kernel versions until the issue is resolved.Exploit
Fix
Buffer Overflow
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Suse
Ubuntu