CVE-2021-29154: Command Injection

Published Apr 6, 2021
·
Updated

A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. A local user with the ability to insert eBPF instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Other sources

An issue has been discovered in the BPF JIT compiler in the Linux kernel that can be abused by priviledged local users (root or CAPSYSADMIN) to escalate privileges. This depends on permission to execute eBPF system call.

Red Hat

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpfjitcomp.c and arch/x86/net/bpfjitcomp32.c.

Linux Kernel could allow a could allow a local authenticated attacker to gain elevated privileges on the system, caused by an issue with incorrect computation of branch displacements in BPF JIT compiler. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges, and execute arbitrary code in the Kernel mode.

IBM

Affected Software

46 affected componentsFixes available
redhat/kernel-rt<0:3.10.0-1160.41.1.rt56.1181.el7
0:3.10.0-1160.41.1.rt56.1181.el7
redhat/kernel<0:3.10.0-1160.41.1.el7
0:3.10.0-1160.41.1.el7
redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8
0:4.18.0-372.9.1.rt7.166.el8
redhat/kernel<0:4.18.0-372.9.1.el8
0:4.18.0-372.9.1.el8
IBM DRM<=2.0.6
Linux Linux kernel>=3.0<4.4.266
Linux Linux kernel>=4.5<4.9.266
Linux Linux kernel>=4.10<4.14.230
Linux Linux kernel>=4.15<4.19.186
Linux Linux kernel>=4.20<5.4.111
Linux Linux kernel>=5.5<5.10.29
Linux Linux kernel>=5.11<5.11.13
Fedoraproject Fedora=33
Debian Debian Linux=9.0
NetApp Cloud Backup
NetApp Hci Management Node
NetApp Solidfire
All of the following
NetApp H300s Firmware
NetApp H300s
All of the following
NetApp H500s Firmware
NetApp H500s
All of the following
NetApp H700s Firmware
NetApp H700s
All of the following
NetApp H300e Firmware
NetApp H300e
All of the following
NetApp H500e Firmware
NetApp H500e
All of the following
NetApp H700e Firmware
NetApp H700e
All of the following
NetApp H410s Firmware
NetApp H410s
NetApp H300s Firmware
NetApp H300s
NetApp H500s Firmware
NetApp H500s
NetApp H700s Firmware
NetApp H700s
NetApp H300e Firmware
NetApp H300e
NetApp H500e Firmware
NetApp H500e
NetApp H700e Firmware
NetApp H700e
NetApp H410s Firmware
NetApp H410s
debian/linux
5.10.223-15.10.257-16.1.170-36.1.174-16.12.86-16.12.90-27.0.10-17.0.12-2

Remediation

Information

This issue does not affect most systems by default. An administrator would need to have enabled the BPF JIT to be affected. It can be disabled immediately with the command: # echo 0 > /proc/sys/net/core/bpf_jit_enable Or it can be disabled for all subsequent boots of the system by setting a value in /etc/sysctl.d/44-bpf-jit-disable ## start file ## net.core.bpf_jit_enable=0 ## end file ##

Event History

Apr 6, 2021
Data Sourced
via Red Hat·04:40 PM
DescriptionSeverityAffected Software
Apr 8, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Sep 11, 2025
Data Sourced
via Launchpad·04:07 AM
Description
May 23, 2026
Data Sourced
via Ubuntu·09:47 AM
RemedyDescriptionSeverityAffected Software
Jun 13, 2026
Data Sourced
via Debian·10:21 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-29154?

CVE-2021-29154 is rated as a critical severity vulnerability due to its potential to allow local users to corrupt memory.

2

How do I fix CVE-2021-29154?

To fix CVE-2021-29154, update your Linux kernel to the specified remedial versions such as 0:3.10.0-1160.41.1.el7 or higher.

3

Which software is affected by CVE-2021-29154?

CVE-2021-29154 affects various Linux kernel versions and implementations, including Red Hat and Debian distributions.

4

Who can exploit CVE-2021-29154?

CVE-2021-29154 can be exploited by local users who are able to insert eBPF instructions into the system.

5

What impact does CVE-2021-29154 have on systems?

The impact of CVE-2021-29154 can lead to potential memory corruption, which could be exploited to gain unauthorized access to system resources.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203