| Vulnerability Name: | CVE-2021-31440 (CCN-201123) |
| Assigned: | 2021-05-03 |
| Published: | 2021-05-03 |
| Updated: | 2022-05-13 |
| Summary: | This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-13661. |
| CVSS v3 Severity: | 7.0 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.1 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Changed
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
7.0 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.1 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
|
| CVSS v2 Severity: | 6.9 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete |
6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
| | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete |
|
| Vulnerability Type: | CWE-682
|
| Vulnerability Consequences: | Gain Privileges |
| References: | Source: MITRE
Type: CNA
CVE-2021-31440
Source: XF
Type: UNKNOWN
linux-kernel-cve202131440-priv-esc(201123)
Source: CCN
Type: Linux Kernel GIT Repository
bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
Source: MISC
Type: Patch, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=10bf4e83167cc68595b85fd73bb91e8f2c086e36
Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210706-0003/
Source: CCN
Type: ZDI-21-503
Linux Kernel eBPF Improper Input Validation Privilege Escalation Vulnerability
Source: MISC
Type: Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-503/
|
| Vulnerable Configuration: | Configuration 1:
cpe:/o:linux:linux_kernel:5.11.15:*:*:*:*:*:*:*
Configuration 2:
cpe:/o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*AND cpe:/h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*
Configuration 3:
cpe:/a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Configuration 4:
cpe:/o:netapp:h500s_firmware:-:*:*:*:*:*:*:*AND cpe:/h:netapp:h500s:-:*:*:*:*:*:*:*
Configuration 5:
cpe:/o:netapp:h700s_firmware:-:*:*:*:*:*:*:*AND cpe:/h:netapp:h700s:-:*:*:*:*:*:*:*
Configuration 6:
cpe:/o:netapp:h300e_firmware:-:*:*:*:*:*:*:*AND cpe:/h:netapp:h300e:-:*:*:*:*:*:*:*
Configuration 7:
cpe:/o:netapp:h500e_firmware:-:*:*:*:*:*:*:*AND cpe:/h:netapp:h500e:-:*:*:*:*:*:*:*
Configuration 8:
cpe:/o:netapp:h700e_firmware:-:*:*:*:*:*:*:*AND cpe:/h:netapp:h700e:-:*:*:*:*:*:*:*
Configuration 9:
cpe:/o:netapp:h410s_firmware:-:*:*:*:*:*:*:*AND cpe:/h:netapp:h410s:-:*:*:*:*:*:*:*
Configuration 10:
cpe:/o:netapp:h300s_firmware:-:*:*:*:*:*:*:*AND cpe:/h:netapp:h300s:-:*:*:*:*:*:*:*
Configuration RedHat 1:
cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*
Configuration RedHat 2:
cpe:/a:redhat:enterprise_linux:8::nfv:*:*:*:*:*
Configuration RedHat 3:
cpe:/a:redhat:enterprise_linux:8::realtime:*:*:*:*:*
Configuration RedHat 4:
cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*
Configuration RedHat 5:
cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*
Configuration RedHat 6:
cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*
 Denotes that component is vulnerable |
| Oval Definitions |
|
| BACK |