kernel: Speculation on pointer arithmetic against bpf_context pointer

A flaw was found in the Linux kernels eBPF verification code. By default accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. A local user with the ability to insert eBPF instructions can use the eBPF verifier to abuse a spectre like flaw where they can infer all...

DEBIAN-CVE-2021-20239

A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality...

CVE-2021-20239

A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality...

CVE-2021-31440

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

DEBIAN-CVE-2021-31829

kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can...

Linux kernel 安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open-source operating system Linux.KVM is one of the kernel-based virtual machines. A security vulnerability exists in the Linux kernel, which can be exploited by a local attacker to read memory fragments through the Linux kernel's BPF in...

Linux Kernel 安全漏洞

Linux Kernel is an open source operating system. A security vulnerability exists in Linux Kernel eBPF, which can be exploited by a local attacker to submit a special request that can elevate privileges...

The vulnerability of component BPF JIT (arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c) in the Linux operating system allows a hacker to execute arbitrary code.

The vulnerability of component BPF JIT arch/x86/net/bpfjitcomp.c and arch/x86/net/bpfjitcomp32.c in the Linux operating system is related to the failure to address the special elements used in the OS command. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability in the BPF subsystem of the `map_create` or `check_btf_info` function of the Linux kernel allows a malicious actor to cause an unexpected termination of the application.

The vulnerability of the BPF subsystem of the mapcreate function kernel/bpf/syscall.c or checkbtfinfo function kernel/bpf/verifier.c in the Linux operating system kernel is due to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to cause an applicati...

USN-4917-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.3, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-kvm, linux-oem-5.10, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-raspi2-5.3 vulnerabilities

It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges. CVE-2021-3493 Vincent Dehors discovered that the shiftfs file...

USN-4916-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-lts-xenial, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges. CVE-2021-3493 Piotr Krysiuk discovered that the BPF JIT...

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.

...

USN-4912-1 linux-oem-5.6 vulnerabilities

Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux kernel did not properly validate computation of branch displacements in some situations. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-29154 It was...

CVE-2021-29154

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpfjitcomp.c and arch/x86/net/bpfjitcomp32.c...

An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF) which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or check_btf_info in kernel/bpf/verifier.c) aka CID-350a5c4dd245.

...

The vulnerability of the BPF mechanism implemented in Linux kernel allows attackers to gain unauthorized access to protected information or execute arbitrary code.

The vulnerability of the BPF mechanism implemented by Linux operating system kernels is related to the lack of a data type conversion mechanism. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or execute arbitrary code...

The vulnerability in the kernel/bpf/verifier.c file of the Linux operating system allows a hacker to gain unauthorized access to protected information.

The vulnerability in the kernel/bpf/verifier.c file of the Linux operating system is related to the disclosure of information due to discrepancies. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

AZL-34857 CVE-2021-20194 affecting package kernel for versions less than 6.6.35.1-4

There is a vulnerability in the linux kernel versions higher than 5.2 if kernel compiled with config params CONFIGBPFSYSCALL=y , CONFIGBPF=y , CONFIGCGROUPS=y , CONFIGCGROUPBPF=y , CONFIGHARDENEDUSERCOPY not set, and BPF hook to getsockopt is registered. As result of BPF execution, the local user...

CVE-2021-20194

There is a vulnerability in the linux kernel versions higher than 5.2 if kernel compiled with config params CONFIGBPFSYSCALL=y , CONFIGBPF=y , CONFIGCGROUPS=y , CONFIGCGROUPBPF=y , CONFIGHARDENEDUSERCOPY not set, and BPF hook to getsockopt is registered. As result of BPF execution, the local user...

UBUNTU-CVE-2021-20239

A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality...