CVE-2021-20194 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	No
Type	Privilege escalation
Description	There is a vulnerability in the Linux kernel versions higher than 5.2 and before version 5.11 (if the kernel is compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger a bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to a heap overflow (because of non-hardened usercopy). The impact of the attack could be a denial of service or possibly privilege escalation.

Group	Package	Affected	Severity	Status
AVG-1561	linux-lts	5.4.96-1	Medium	Not affected
AVG-1560	linux-zen	5.10.14.zen1-1	Medium	Not affected
AVG-1559	linux-hardened	5.10.14.hardened1-1	Medium	Not affected
AVG-1558	linux	5.10.14.arch1-1	Medium	Not affected

References
https://bugzilla.redhat.com/show_bug.cgi?id=1912683 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=bb8b81e396f7afbe7c50d789e2107512274d2a35 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=f4a2da755a7e1f5d845c52aee71336cee289935a

References

https://bugzilla.redhat.com/show_bug.cgi?id=1912683
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=bb8b81e396f7afbe7c50d789e2107512274d2a35
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=f4a2da755a7e1f5d845c52aee71336cee289935a

Notes
Workaround ========== The issue can be mitigated by setting "sysctl kernel.unprivileged_bpf_disabled=1".