CVE-2021-3490

🗓️ 04 Jun 2021 01:40:20Reported by canonicalType

cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 445 Views

eBPF ALU32 bounds tracking vulnerability in Linux kernel allows for arbitrary code execution. Fixed in v5.13-rc4, v5.12.4, v5.11.21, v5.10.37

Reporter	Title	Published	Views	Family All 148
0day.today	Linux eBPF ALU32 32-bit Invalid Bounds Tracking Local Privilege Escalation Exploit	1 Sep 202100:00	–	zdt
GithubExploit	Exploit for Improper Input Validation in Linux Linux_Kernel	24 Jun 202118:50	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Linux Linux_Kernel	6 Apr 202303:21	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Linux Linux_Kernel	4 Mar 202607:51	–	githubexploit
Tenable Nessus	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-001)	2 May 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-002 (ALASKERNEL-5.10-2022-002)	2 May 202200:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:1975-1)	16 Jul 202100:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:1977-1)	16 Jul 202100:00	–	nessus
Tenable Nessus	Photon OS 4.0: Linux PHSA-2021-4.0-0023	12 May 202100:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : kernel (SUSE-SU-2021:1975-1)	21 Jun 202100:00	–	nessus

NVD

Node

linux linux_kernelRange5.10–5.10.37

linux linux_kernelRange5.11–5.11.21

linux linux_kernelRange5.12–5.12.4

linux linux_kernelMatch5.13-

linux linux_kernelMatch5.13rc1

linux linux_kernelMatch5.13rc2

linux linux_kernelMatch5.13rc3

Node

canonical ubuntu_linuxMatch20.04lts

canonical ubuntu_linuxMatch20.10

canonical ubuntu_linuxMatch21.04

[
  {
    "product": "Linux kernel",
    "vendor": "Linux",
    "versions": [
      {
        "lessThan": "v5.13-rc4",
        "status": "affected",
        "version": "trunk",
        "versionType": "custom"
      },
      {
        "lessThan": "v5.12.4",
        "status": "affected",
        "version": "linux-5.12.y",
        "versionType": "custom"
      },
      {
        "lessThan": "v5.11.21",
        "status": "affected",
        "version": "linux-5.11.y",
        "versionType": "custom"
      },
      {
        "lessThan": "v5.10.37",
        "status": "affected",
        "version": "linux-5.10.y",
        "versionType": "custom"
      },
      {
        "lessThan": "5.7*",
        "status": "affected",
        "version": "v5.7-rc1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.html
ubuntu	www.ubuntu.com/security/notices/USN-4950-1
git	www.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/
security	www.security.netapp.com/advisory/ntap-20210716-0004/
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-21-606/
ubuntu	www.ubuntu.com/security/notices/USN-4949-1
openwall	www.openwall.com/lists/oss-security/2021/05/11/11

21 Nov 2024 06:21Current

8.1High risk

Vulners AI Score8.1

CVSS 27.2

CVSS 3.17.8

EPSS0.03757

cve-2021-3490 ebpf alu32 bounds tracking linux kernel arbitrary code execution security nvd