cve-2021-47607
Vulnerability from cvelistv5
Published
2024-06-19 14:54
Modified
2024-11-04 12:09
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg The implementation of BPF_CMPXCHG on a high level has the following parameters: .-[old-val] .-[new-val] BPF_R0 = cmpxchg{32,64}(DST_REG + insn->off, BPF_R0, SRC_REG) `-[mem-loc] `-[old-val] Given a BPF insn can only have two registers (dst, src), the R0 is fixed and used as an auxilliary register for input (old value) as well as output (returning old value from memory location). While the verifier performs a number of safety checks, it misses to reject unprivileged programs where R0 contains a pointer as old value. Through brute-forcing it takes about ~16sec on my machine to leak a kernel pointer with BPF_CMPXCHG. The PoC is basically probing for kernel addresses by storing the guessed address into the map slot as a scalar, and using the map value pointer as R0 while SRC_REG has a canary value to detect a matching address. Fix it by checking R0 for pointers, and reject if that's the case for unprivileged programs.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a82fe085f344ef20b452cd5f481010ff96b5c4cdPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f87a6c160ecc8c7b417d25f508d3f076fe346136Patch
Impacted products
Vendor Product Version
Linux Linux Version: 5.12
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:47:40.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f87a6c160ecc8c7b417d25f508d3f076fe346136"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a82fe085f344ef20b452cd5f481010ff96b5c4cd"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47607",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:12:04.882836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:51.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f87a6c160ecc",
              "status": "affected",
              "version": "5ffa25502b5a",
              "versionType": "git"
            },
            {
              "lessThan": "a82fe085f344",
              "status": "affected",
              "version": "5ffa25502b5a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix kernel address leakage in atomic cmpxchg\u0027s r0 aux reg\n\nThe implementation of BPF_CMPXCHG on a high level has the following parameters:\n\n  .-[old-val]                                          .-[new-val]\n  BPF_R0 = cmpxchg{32,64}(DST_REG + insn-\u003eoff, BPF_R0, SRC_REG)\n                          `-[mem-loc]          `-[old-val]\n\nGiven a BPF insn can only have two registers (dst, src), the R0 is fixed and\nused as an auxilliary register for input (old value) as well as output (returning\nold value from memory location). While the verifier performs a number of safety\nchecks, it misses to reject unprivileged programs where R0 contains a pointer as\nold value.\n\nThrough brute-forcing it takes about ~16sec on my machine to leak a kernel pointer\nwith BPF_CMPXCHG. The PoC is basically probing for kernel addresses by storing the\nguessed address into the map slot as a scalar, and using the map value pointer as\nR0 while SRC_REG has a canary value to detect a matching address.\n\nFix it by checking R0 for pointers, and reject if that\u0027s the case for unprivileged\nprograms."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T12:09:04.087Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f87a6c160ecc8c7b417d25f508d3f076fe346136"
        },
        {
          "url": "https://git.kernel.org/stable/c/a82fe085f344ef20b452cd5f481010ff96b5c4cd"
        }
      ],
      "title": "bpf: Fix kernel address leakage in atomic cmpxchg\u0027s r0 aux reg",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47607",
    "datePublished": "2024-06-19T14:54:05.700Z",
    "dateReserved": "2024-05-24T15:11:00.737Z",
    "dateUpdated": "2024-11-04T12:09:04.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47607\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T15:15:55.263\",\"lastModified\":\"2024-10-31T14:07:03.140\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix kernel address leakage in atomic cmpxchg\u0027s r0 aux reg\\n\\nThe implementation of BPF_CMPXCHG on a high level has the following parameters:\\n\\n  .-[old-val]                                          .-[new-val]\\n  BPF_R0 = cmpxchg{32,64}(DST_REG + insn-\u003eoff, BPF_R0, SRC_REG)\\n                          `-[mem-loc]          `-[old-val]\\n\\nGiven a BPF insn can only have two registers (dst, src), the R0 is fixed and\\nused as an auxilliary register for input (old value) as well as output (returning\\nold value from memory location). While the verifier performs a number of safety\\nchecks, it misses to reject unprivileged programs where R0 contains a pointer as\\nold value.\\n\\nThrough brute-forcing it takes about ~16sec on my machine to leak a kernel pointer\\nwith BPF_CMPXCHG. The PoC is basically probing for kernel addresses by storing the\\nguessed address into the map slot as a scalar, and using the map value pointer as\\nR0 while SRC_REG has a canary value to detect a matching address.\\n\\nFix it by checking R0 for pointers, and reject if that\u0027s the case for unprivileged\\nprograms.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: corrige la fuga de direcci\u00f3n del kernel en el registro auxiliar r0 de atomic cmpxchg. La implementaci\u00f3n de BPF_CMPXCHG en un nivel alto tiene los siguientes par\u00e1metros: .-[old-val] .-[new-val ] BPF_R0 = cmpxchg{32,64}(DST_REG + insn-\u0026gt;off, BPF_R0, SRC_REG) `-[mem-loc] `-[old-val] Dado un BPF insn solo puede tener dos registros (dst, src), el R0 es fijo y se utiliza como registro auxiliar para la entrada (valor anterior), as\u00ed como para la salida (devolver el valor anterior desde la ubicaci\u00f3n de la memoria). Si bien el verificador realiza una serie de comprobaciones de seguridad, no rechaza los programas sin privilegios donde R0 contiene un puntero como valor antiguo. A trav\u00e9s de la fuerza bruta, en mi m\u00e1quina se necesitan aproximadamente 16 segundos para filtrar un puntero del kernel con BPF_CMPXCHG. B\u00e1sicamente, PoC busca direcciones del kernel almacenando la direcci\u00f3n adivinada en la ranura del mapa como un escalar y usando el puntero del valor del mapa como R0, mientras que SRC_REG tiene un valor canario para detectar una direcci\u00f3n coincidente. Solucionelo comprobando R0 en busca de punteros y rech\u00e1celo si ese es el caso de los programas sin privilegios.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.15.11\",\"matchCriteriaId\":\"9E292CA0-C53B-4C70-B5CE-94AC1BC7673F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F621B5E3-E99D-49E7-90B9-EC3B77C95383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7BFDCAA-1650-49AA-8462-407DD593F94F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EC9882F-866D-4ACB-8FBC-213D8D8436C8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a82fe085f344ef20b452cd5f481010ff96b5c4cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f87a6c160ecc8c7b417d25f508d3f076fe346136\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.