Skip to content
OpenAdvisories
High · 7.8 Public exploit CVE-2021-3490 EUVD-2021-26812GHSA-9wfm-q59x-qc3x

Linux kernel eBPF bitwise ops ALU32 bounds tracking

Published Jun 4, 2021 · Updated Sep 16, 2024 · Assigned by canonical

Vendor: Linux Product: linux_kernel Package: linux Package: linux-aws-5.0 Package: linux-aws-5.3 Package: linux-azure Package: linux-azure-5.3 Package: linux-azure-edge Package: linux-gcp Package: linux-gcp-5.3 Package: linux-gcp-edge Package: linux-hwe Package: linux-hwe-5.8 Package: linux-hwe-edge Package: linux-oem-5.10 Package: linux-oracle-5.0 Package: linux-oracle-5.3 Package: linux-raspi2 Package: linux-riscv-5.8 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).

Affected products

VendorProductAffectedFixed
Linux Linux kernel trunk – < v5.13-rc4, linux-5.12.y – < v5.12.4, linux-5.11.y – < v5.11.21, linux-5.10.y – < v5.10.37, v5.7-rc1 – < 5.7* v5.13-rc4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 linux 5.10.38-1 —
Debian 13 linux 5.10.38-1 —
Debian 12 linux 5.10.38-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-hwe-5.8 5.8.0-53.60~20.04.1 USN-4949-1
Ubuntu 20.04 LTS linux-oem-5.10 5.10.0-1026.27 USN-4948-1
Ubuntu 20.04 LTS linux-raspi2 No fix yet —
Ubuntu 20.04 LTS linux-riscv-5.8 5.8.0-25.27~20.04.1 —
Ubuntu 18.04 LTS linux-gcp +11 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP3 kernel-64kb +5 5.3.18-59.5.2 SUSE-SU-2021:1977-1
SLES 15 SP3 kernel-azure +2 5.3.18-38.3.1 SUSE-SU-2021:1975-1
SLES 15 SP3 kernel-default-base 5.3.18-59.5.2.18.2.2 SUSE-SU-2021:1977-1
SLES 15 SP3 kernel-syms +1 5.3.18-59.5.1 SUSE-SU-2021:1977-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Live Patching 15 SP3 kernel-default 5.3.18-59.5.2 SUSE-SU-2021:1977-1
SLE Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_0 2-3.1 SUSE-SU-2021:2198-1
SLE Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_1 1-7.5.1 SUSE-SU-2021:1977-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed kernel-source 5.14.6-1.4 openSUSE-SU-2024:13704-1, openSUSE-SU-2024:10728-1
openSUSE Leap 15.3 kernel-64kb +7 5.3.18-59.5.2 openSUSE-SU-2021:1977-1
openSUSE Leap 15.3 kernel-azure +2 5.3.18-38.3.1 openSUSE-SU-2021:1975-1
openSUSE Leap 15.3 kernel-default-base 5.3.18-59.5.2.18.2.2 openSUSE-SU-2021:1977-1
openSUSE Leap 15.3 kernel-syms +2 5.3.18-59.5.1 openSUSE-SU-2021:1977-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 5 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 9

References