CVE-2021-29154: Command Injection
A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. A local user with the ability to insert eBPF instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
An issue has been discovered in the BPF JIT compiler in the Linux kernel that can be abused by priviledged local users (root or CAPSYSADMIN) to escalate privileges. This depends on permission to execute eBPF system call.
— Red Hat
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpfjitcomp.c and arch/x86/net/bpfjitcomp32.c.
Linux Kernel could allow a could allow a local authenticated attacker to gain elevated privileges on the system, caused by an issue with incorrect computation of branch displacements in BPF JIT compiler. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges, and execute arbitrary code in the Kernel mode.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.41.1.rt56.1181.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.41.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.rt7.166.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.96-1Fixed in 7.1.3-1Fixed in 7.1.5-1 - Configuration
Disable the BPF JIT immediately by running: echo 0 > /proc/sys/net/core/bpf_jit_enable
Linux kernel eBPF JIT (sysctl net.core.bpf_jit_enable) net.core.bpf_jit_enable = 0 - Configuration
Disable BPF JIT for all subsequent boots by setting the value in /etc/sysctl.d/44-bpf-jit-disable to net.core.bpf_jit_enable=0
Linux kernel eBPF JIT (sysctl persistent setting) /etc/sysctl.d/44-bpf-jit-disable = net.core.bpf_jit_enable=0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-29154?
CVE-2021-29154 is rated as a critical severity vulnerability due to its potential to allow local users to corrupt memory.
How do I fix CVE-2021-29154?
To fix CVE-2021-29154, update your Linux kernel to the specified remedial versions such as 0:3.10.0-1160.41.1.el7 or higher.
Which software is affected by CVE-2021-29154?
CVE-2021-29154 affects various Linux kernel versions and implementations, including Red Hat and Debian distributions.
Who can exploit CVE-2021-29154?
CVE-2021-29154 can be exploited by local users who are able to insert eBPF instructions into the system.
What impact does CVE-2021-29154 have on systems?
The impact of CVE-2021-29154 can lead to potential memory corruption, which could be exploited to gain unauthorized access to system resources.