CVE-2021-41864
prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.
02 / AFFECTED SOFTWARE
Affected packages
1 explicit affected versions
695 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In prealloc_elems_and_freelist of stackmap.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.
05 / REFERENCES
Further evidence
- https://android.googlesource.com/kernel/common/+/30e29a9a2bc6a4888335a6ede968b75cd329657a
- https://source.android.com/security/bulletin/2022-03-01
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.12
- https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
- https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
- https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
- https://security.netapp.com/advisory/ntap-20211029-0004/
- https://www.debian.org/security/2022/dsa-5096