UBUNTU-CVE-2021-20194
There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation.
02 / AFFECTED SOFTWARE
Affected packages
50 explicit affected versions
6 explicit affected versions
6 explicit affected versions
23 explicit affected versions
23 explicit affected versions
1 explicit affected versions
13 explicit affected versions
1 explicit affected versions
7 explicit affected versions
12 explicit affected versions
1 explicit affected versions
25 explicit affected versions
33 explicit affected versions
24 explicit affected versions
10 explicit affected versions
10 explicit affected versions
1 explicit affected versions
5 explicit affected versions
25 explicit affected versions
13 explicit affected versions
27 explicit affected versions
33 explicit affected versions
10 explicit affected versions
11 explicit affected versions
25 explicit affected versions
21 explicit affected versions
1 explicit affected versions
5 explicit affected versions
15 explicit affected versions
1 explicit affected versions
15 explicit affected versions
1 explicit affected versions
4 explicit affected versions
14 explicit affected versions
44 explicit affected versions
16 explicit affected versions
10 explicit affected versions
38 explicit affected versions
9 explicit affected versions
15 explicit affected versions
14 explicit affected versions
43 explicit affected versions
1 explicit affected versions
12 explicit affected versions
18 explicit affected versions
4 explicit affected versions
5 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation.
05 / REFERENCES
Further evidence
- https://bugzilla.redhat.com/show_bug.cgi?id=1912683
- https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/#23921223
- https://ubuntu.com/security/CVE-2021-20194
- https://ubuntu.com/security/notices/USN-4879-1
- https://ubuntu.com/security/notices/USN-4884-1
- https://ubuntu.com/security/notices/USN-4909-1
- https://ubuntu.com/security/notices/USN-4912-1
- https://www.cve.org/CVERecord?id=CVE-2021-20194