CVE-2021-29154
published 2021-04-08CVE-2021-29154: BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the…
PriorityP343high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.93%
56.7th percentile
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 5.10.28-1 (bookworm) | linux 5.10.28-1 (bookworm) |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | >= 0 < 5.10.28-1 | 5.10.28-1 |
| linux | linux_kernel | >= 0 < 5.10.28-1 | 5.10.28-1 |
| linux | linux_kernel | >= 0 < 5.10.28-1 | 5.10.28-1 |
| linux | linux_kernel | >= 0 < 5.10.28-1 | 5.10.28-1 |
| linux | linux_kernel | >= 0 < 4.4.0-210.242 | 4.4.0-210.242 |
| linux | linux_kernel | >= 0 < 4.4.0-209.241 | 4.4.0-209.241 |
| linux | linux_kernel | >= 0 < 4.15.0-142.146 | 4.15.0-142.146 |
| linux | linux_kernel | >= 0 < 5.4.0-72.80 | 5.4.0-72.80 |
| linux | linux_kernel | >= 0 < 4.4.0-209.241 | 4.4.0-209.241 |
| linux | linux_kernel | >= 0 < 4.15.0-142.146 | 4.15.0-142.146 |
| linux | linux_kernel | >= 0 < 5.4.0-72.80 | 5.4.0-72.80 |
| linux | linux_kernel | >= 3.0 < 4.4.266 | 4.4.266 |
| linux | linux_kernel | >= 4.10 < 4.14.230 | 4.14.230 |
| linux | linux_kernel | >= 4.15 < 4.19.186 | 4.19.186 |
| linux | linux_kernel | >= 4.20 < 5.4.111 | 5.4.111 |
| linux | linux_kernel | >= 4.5 < 4.9.266 | 4.9.266 |
| linux | linux_kernel | >= 5.11 < 5.11.13 | 5.11.13 |
| linux | linux_kernel | >= 5.5 < 5.10.29 | 5.10.29 |
| msrc | cbl2_kernel_5.10.78.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2021-05-03·CVSS 7.8
CVE-2021-29154 [HIGH] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges.(CVE-2021-3493)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code.(CVE-2021-29154)
Ubuntu
Linux kernel regression
vendor_ubuntu·2021-04-22·CVSS 7.8
CVE-2021-3493 [HIGH] Linux kernel regression
Title: Linux kernel regression
Summary: USN-4916-1 introduced a regression in the Linux kernel.
USN-4916-1 fixed vulnerabilities in the Linux kernel. Unfortunately,
the fix for CVE-2021-3493 introduced a memory leak in some situations.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges. (CVE-2021-3493)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial o
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-04-15·CVSS 7.8
CVE-2021-3493 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges. (CVE-2021-3493)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI ch
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-04-15·CVSS 7.8
CVE-2021-3492 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges. (CVE-2021-3493)
Vincent Dehors discovered that the shiftfs file system in the Ubuntu Linux
kernel did not properly handle faults in copy_from_user() when passing
through ioctls to an underlying file system. A local attacker could use
this to cause a denial of service (memory exhaustion) or execute arbitrary
code. (CVE-2021-3492)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch d
Microsoft
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bp
vendor_msrc·2021-04-13·CVSS 7.8
CVE-2021-29154 [HIGH] CWE-77 BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bp
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additi
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2021-04-13·CVSS 7.8
CVE-2020-14351 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
It was discovered that the HID multitouch implementation within the Linux
kernel did not properly validate input events in som
Red Hat
kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation
vendor_redhat·2021-04-08·CVSS 7.8
CVE-2021-29154 [HIGH] CWE-119 kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation
kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only accessible to privileged users with CAP_SYS_ADMIN. A local user with the ability to insert eBPF instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Statement: This flaw is rated as having Moderate impact as eBPF requires a privileged u
Debian
CVE-2021-29154: linux - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation...
vendor_debian·2021·CVSS 7.8
CVE-2021-29154 [HIGH] CVE-2021-29154: linux - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation...
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
Scope: local
bookworm: resolved (fixed in 5.10.28-1)
bullseye: resolved (fixed in 5.10.28-1)
forky: resolved (fixed in 5.10.28-1)
sid: resolved (fixed in 5.10.28-1)
trixie: resolved (fixed in 5.10.28-1)
GHSA
GHSA-q7mp-r58x-5fjf: Incorrect computation of branch displacements in BPF JIT compilers the Linux kernel can be abused to execute arbitrary code in Kernel mode
ghsa_unreviewed·2022-05-24
CVE-2021-29154 [HIGH] CWE-77 GHSA-q7mp-r58x-5fjf: Incorrect computation of branch displacements in BPF JIT compilers the Linux kernel can be abused to execute arbitrary code in Kernel mode
Incorrect computation of branch displacements in BPF JIT compilers the Linux kernel can be abused to execute arbitrary code in Kernel mode.
OSV
Kernel Live Patch Security Notice
osv·2021-05-03·CVSS 7.8
CVE-2021-3493 [HIGH] Kernel Live Patch Security Notice
Kernel Live Patch Security Notice
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges.(CVE-2021-3493)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code.(CVE-2021-29154)
OSV
linux, linux-aws, linux-gke-5.3, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem-5.6, linux-raspi2, linux-raspi2-5.3, linux-snapdragon regression
osv·2021-04-22·CVSS 7.8
CVE-2021-3493 [HIGH] linux, linux-aws, linux-gke-5.3, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem-5.6, linux-raspi2, linux-raspi2-5.3, linux-snapdragon regression
linux, linux-aws, linux-gke-5.3, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem-5.6, linux-raspi2, linux-raspi2-5.3, linux-snapdragon regression
USN-4916-1 fixed vulnerabilities in the Linux kernel. Unfortunately,
the fix for CVE-2021-3493 introduced a memory leak in some situations.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges. (CVE-2021-3493)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations.
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.3, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-kvm,
osv·2021-04-15·CVSS 7.8
[HIGH] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.3, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-kvm,
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.3, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-kvm, linux-oem-5.10, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-raspi2-5.3 vulnerabilities
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges. (CVE-2021-3493)
Vincent Dehors discovered that the shiftfs file system in the Ubuntu Linux
kernel did not properly handle faults in copy_from_user() when passing
through ioctls to an underlying file system. A local attacker could use
this to cause a
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-lts-xenial, linux-oracle, linux-raspi2, linux-snapdragon vulnerab
osv·2021-04-15·CVSS 7.8
CVE-2021-3493 [HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-lts-xenial, linux-oracle, linux-raspi2, linux-snapdragon vulnerab
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-lts-xenial, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges. (CVE-2021-3493)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
OSV
linux-oem-5.6 vulnerabilities
osv·2021-04-13·CVSS 7.8
CVE-2021-29154 [HIGH] linux-oem-5.6 vulnerabilities
linux-oem-5.6 vulnerabilities
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
It was discovered that the HID multitouch implementation within the Linux
kernel did not properly validate input events in some situations. A
physically proximate attacker could use this to cause a denial
OSV
CVE-2021-29154: BPF JIT compilers in the Linux kernel through 5
osv·2021-04-08·CVSS 7.8
CVE-2021-29154 [HIGH] CVE-2021-29154: BPF JIT compilers in the Linux kernel through 5
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.htmlhttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=26f55a59dc65ff77cd1c4b37991e26497fc68049https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4d4d456436bfb2fe412ee2cd489f7658449b098https://lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlhttps://lists.debian.org/debian-lts-announce/2021/06/msg00020.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5YFGIIF24475A2LNW3UWHW2SNCS3G7M/https://news.ycombinator.com/item?id=26757760https://security.netapp.com/advisory/ntap-20210604-0006/https://www.openwall.com/lists/oss-security/2021/04/08/1https://www.oracle.com/security-alerts/cpujul2022.htmlhttp://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.htmlhttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=26f55a59dc65ff77cd1c4b37991e26497fc68049https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4d4d456436bfb2fe412ee2cd489f7658449b098https://lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlhttps://lists.debian.org/debian-lts-announce/2021/06/msg00020.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5YFGIIF24475A2LNW3UWHW2SNCS3G7M/https://news.ycombinator.com/item?id=26757760https://security.netapp.com/advisory/ntap-20210604-0006/https://www.openwall.com/lists/oss-security/2021/04/08/1https://www.oracle.com/security-alerts/cpujul2022.html
2021-04-08
Published