cve-2021-47607
Vulnerability from cvelistv5
Published
2024-06-19 14:54
Modified
2024-09-11 17:34
Severity
Summary
bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a82fe085f344ef20b452cd5f481010ff96b5c4cd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f87a6c160ecc8c7b417d25f508d3f076fe346136
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:47:40.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f87a6c160ecc8c7b417d25f508d3f076fe346136"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a82fe085f344ef20b452cd5f481010ff96b5c4cd"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47607",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:12:04.882836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:51.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f87a6c160ecc",
              "status": "affected",
              "version": "5ffa25502b5a",
              "versionType": "git"
            },
            {
              "lessThan": "a82fe085f344",
              "status": "affected",
              "version": "5ffa25502b5a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.11",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix kernel address leakage in atomic cmpxchg\u0027s r0 aux reg\n\nThe implementation of BPF_CMPXCHG on a high level has the following parameters:\n\n  .-[old-val]                                          .-[new-val]\n  BPF_R0 = cmpxchg{32,64}(DST_REG + insn-\u003eoff, BPF_R0, SRC_REG)\n                          `-[mem-loc]          `-[old-val]\n\nGiven a BPF insn can only have two registers (dst, src), the R0 is fixed and\nused as an auxilliary register for input (old value) as well as output (returning\nold value from memory location). While the verifier performs a number of safety\nchecks, it misses to reject unprivileged programs where R0 contains a pointer as\nold value.\n\nThrough brute-forcing it takes about ~16sec on my machine to leak a kernel pointer\nwith BPF_CMPXCHG. The PoC is basically probing for kernel addresses by storing the\nguessed address into the map slot as a scalar, and using the map value pointer as\nR0 while SRC_REG has a canary value to detect a matching address.\n\nFix it by checking R0 for pointers, and reject if that\u0027s the case for unprivileged\nprograms."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-19T14:54:05.700Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f87a6c160ecc8c7b417d25f508d3f076fe346136"
        },
        {
          "url": "https://git.kernel.org/stable/c/a82fe085f344ef20b452cd5f481010ff96b5c4cd"
        }
      ],
      "title": "bpf: Fix kernel address leakage in atomic cmpxchg\u0027s r0 aux reg",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47607",
    "datePublished": "2024-06-19T14:54:05.700Z",
    "dateReserved": "2024-05-24T15:11:00.737Z",
    "dateUpdated": "2024-09-11T17:34:51.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47607\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T15:15:55.263\",\"lastModified\":\"2024-06-20T12:43:25.663\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix kernel address leakage in atomic cmpxchg\u0027s r0 aux reg\\n\\nThe implementation of BPF_CMPXCHG on a high level has the following parameters:\\n\\n  .-[old-val]                                          .-[new-val]\\n  BPF_R0 = cmpxchg{32,64}(DST_REG + insn-\u003eoff, BPF_R0, SRC_REG)\\n                          `-[mem-loc]          `-[old-val]\\n\\nGiven a BPF insn can only have two registers (dst, src), the R0 is fixed and\\nused as an auxilliary register for input (old value) as well as output (returning\\nold value from memory location). While the verifier performs a number of safety\\nchecks, it misses to reject unprivileged programs where R0 contains a pointer as\\nold value.\\n\\nThrough brute-forcing it takes about ~16sec on my machine to leak a kernel pointer\\nwith BPF_CMPXCHG. The PoC is basically probing for kernel addresses by storing the\\nguessed address into the map slot as a scalar, and using the map value pointer as\\nR0 while SRC_REG has a canary value to detect a matching address.\\n\\nFix it by checking R0 for pointers, and reject if that\u0027s the case for unprivileged\\nprograms.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: corrige la fuga de direcci\u00f3n del kernel en el registro auxiliar r0 de atomic cmpxchg. La implementaci\u00f3n de BPF_CMPXCHG en un nivel alto tiene los siguientes par\u00e1metros: .-[old-val] .-[new-val ] BPF_R0 = cmpxchg{32,64}(DST_REG + insn-\u0026gt;off, BPF_R0, SRC_REG) `-[mem-loc] `-[old-val] Dado un BPF insn solo puede tener dos registros (dst, src), el R0 es fijo y se utiliza como registro auxiliar para la entrada (valor anterior), as\u00ed como para la salida (devolver el valor anterior desde la ubicaci\u00f3n de la memoria). Si bien el verificador realiza una serie de comprobaciones de seguridad, no rechaza los programas sin privilegios donde R0 contiene un puntero como valor antiguo. A trav\u00e9s de la fuerza bruta, en mi m\u00e1quina se necesitan aproximadamente 16 segundos para filtrar un puntero del kernel con BPF_CMPXCHG. B\u00e1sicamente, PoC busca direcciones del kernel almacenando la direcci\u00f3n adivinada en la ranura del mapa como un escalar y usando el puntero del valor del mapa como R0, mientras que SRC_REG tiene un valor canario para detectar una direcci\u00f3n coincidente. Solucionelo comprobando R0 en busca de punteros y rech\u00e1celo si ese es el caso de los programas sin privilegios.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a82fe085f344ef20b452cd5f481010ff96b5c4cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f87a6c160ecc8c7b417d25f508d3f076fe346136\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.