CVE-2021-33200

2021-05-2700:00:00

ubuntu.com

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.3%

JSON

kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect
limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be
abused to perform out-of-bounds reads and writes in kernel memory, leading
to local privilege escalation to root. In particular, there is a corner
case where the off reg causes a masking direction change, which then
results in an incorrect final aux->alu_limit.

OSVersionArchitecturePackageVersionFilename
ubuntu21.04noarchlinux< 5.11.0-22.23UNKNOWN
ubuntu21.04noarchlinux-aws< 5.11.0-1011.11UNKNOWN
ubuntu21.04noarchlinux-azure< 5.11.0-1009.9UNKNOWN
ubuntu21.04noarchlinux-gcp< 5.11.0-1011.12UNKNOWN
ubuntu21.04noarchlinux-kvm< 5.11.0-1009.9UNKNOWN
ubuntu21.04noarchlinux-oracle< 5.11.0-1010.10UNKNOWN
ubuntu21.04noarchlinux-raspi< 5.11.0-1012.13UNKNOWN
ubuntu21.04noarchlinux-riscv< 5.11.0-1012.12UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	21.04	noarch	linux	< 5.11.0-22.23	UNKNOWN
ubuntu	21.04	noarch	linux-aws	< 5.11.0-1011.11	UNKNOWN
ubuntu	21.04	noarch	linux-azure	< 5.11.0-1009.9	UNKNOWN
ubuntu	21.04	noarch	linux-gcp	< 5.11.0-1011.12	UNKNOWN
ubuntu	21.04	noarch	linux-kvm	< 5.11.0-1009.9	UNKNOWN
ubuntu	21.04	noarch	linux-oracle	< 5.11.0-1010.10	UNKNOWN
ubuntu	21.04	noarch	linux-raspi	< 5.11.0-1012.13	UNKNOWN
ubuntu	21.04	noarch	linux-riscv	< 5.11.0-1012.12	UNKNOWN