A vulnerability (CVE-2021-3600) has been identified in the eBPF subsystem, which allows handlers to run within the Linux kernel in a special JIT virtual machine, enabling a local unprivileged user to execute their code at the kernel level. The issue is caused by improper truncation of 32-bit registers during 'div' and 'mod' operations, which may lead to reading and writing data outside of the allocated memory area.
The vulnerability was introduced in an incorrect fix for 32-bit division by zero in release 4.15, which has also been backported to the 4.4.x, 4.9.x, and 4.14.x branches. Exploitation of the vulnerability is possible for kernels starting with version 4.14, in which the method for tracking values in the BPF verifier was changed. The issue has been resolved in Linux kernel 5.11. The fix has been backported to the 5.10.x and 5.4.x branches but not to the 4.19.x and 4.14.x branches. An update with the vulnerability fix has been released for Ubuntu and Debian Sid. It remains unclear whether the issue is present in SUSE and RHEL.
Source: opennet.ru
