CVE-2021-20194 - log back

CVE-2021-20194 edited at 24 Feb 2021 14:38:13
Description
- There is a vulnerability in the Linux kernel versions higher than 5.2 (if the kernel is compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger a bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to a heap overflow (because of non-hardened usercopy). The impact of the attack could be a denial of service or possibly privilege escalation.
+ There is a vulnerability in the Linux kernel versions higher than 5.2 and before version 5.11 (if the kernel is compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger a bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to a heap overflow (because of non-hardened usercopy). The impact of the attack could be a denial of service or possibly privilege escalation.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1912683
- https://patchwork.kernel.org/project/netdevbpf/patch/20210122164232.61770-1-loris.reiff@liblor.ch/
+ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=bb8b81e396f7afbe7c50d789e2107512274d2a35
+ https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=f4a2da755a7e1f5d845c52aee71336cee289935a
CVE-2021-20194 edited at 10 Feb 2021 08:42:22
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Local
Type
- Unknown
+ Privilege escalation
Description
+ There is a vulnerability in the Linux kernel versions higher than 5.2 (if the kernel is compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger a bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to a heap overflow (because of non-hardened usercopy). The impact of the attack could be a denial of service or possibly privilege escalation.
References
+ https://bugzilla.redhat.com/show_bug.cgi?id=1912683
+ https://patchwork.kernel.org/project/netdevbpf/patch/20210122164232.61770-1-loris.reiff@liblor.ch/
Notes
+ Workaround
+ ==========
+
+ The issue can be mitigated by setting "sysctl kernel.unprivileged_bpf_disabled=1".
CVE-2021-20194 created at 10 Feb 2021 08:39:43