Severity
7.8HIGH
EPSS
0.2%
top 63.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 8

Description

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 1.1 | Impact: 6.0

Affected Packages11 packages

NVDlinux/linux_kernel4.14.1154.14.308+4
Debianlinux< 5.10.19-1+3
Ubuntulinux< 4.4.0-212.244+2
Ubuntulinux-gcp< 5.4.0-1049.53

Also affects: Ubuntu Linux 14.04, 16.04, 18.04, Enterprise Linux 8.0, Fedora 34

Patches

🔴Vulnerability Details

5
GHSA
GHSA-769h-g9v6-cwg7: It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div2024-01-08
CVEList
CVE-2021-3600: It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div2024-01-08
OSV
CVE-2021-3600: It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div2024-01-08
OSV
Kernel Live Patch Security Notice2021-07-26
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities2021-06-23

💥Exploits & PoCs

1
Nuclei
Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass

📋Vendor Advisories

4
Ubuntu
Kernel Live Patch Security Notice2021-07-26
Red Hat
kernel: eBPF 32-bit source register truncation on div/mod2021-06-23
Ubuntu
Linux kernel vulnerabilities2021-06-23
Debian
CVE-2021-3600: linux - It was discovered that the eBPF implementation in the Linux kernel did not prope...2021
CVE-2021-3600 (HIGH CVSS 7.8) | It was discovered that the eBPF imp | cvebase.io