CVE-2021-46974

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-46974
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix masking negation logic upon negative dst register The negation logic for the case where the off_reg is sitting in the dst register is not correct given then we cannot just invert the add to a sub or vice versa. As a fix, perform the final bitwise and-op unconditionally into AX from the off_reg, then move the pointer from the src to dst and finally use AX as the source for the original pointer arithmetic operation such that the inversion yields a correct result. The single non-AX mov in between is possible given constant blinding is retaining it as it's not an immediate based operation.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0e2dfdc74a7f4036127356d42ea59388f153f42c Patch
https://git.kernel.org/stable/c/2cfa537674cd1051a3b8111536d77d0558f33d5d Patch
https://git.kernel.org/stable/c/4d542ddb88fb2f39bf7f14caa2902f3e8d06f6ba Patch
https://git.kernel.org/stable/c/53e0db429b37a32b8fc706d0d90eb4583ad13848 Patch
https://git.kernel.org/stable/c/6eba92a4d4be8feb4dc33976abac544fa99d6ecc Patch
https://git.kernel.org/stable/c/7cf64d8679ca1cb20cf57d6a88bfee79a0922a66 Patch
https://git.kernel.org/stable/c/b9b34ddbe2076ade359cd5ce7537d5ed019e9807 Patch
https://git.kernel.org/stable/c/0e2dfdc74a7f4036127356d42ea59388f153f42c Patch
https://git.kernel.org/stable/c/2cfa537674cd1051a3b8111536d77d0558f33d5d Patch
https://git.kernel.org/stable/c/4d542ddb88fb2f39bf7f14caa2902f3e8d06f6ba Patch
https://git.kernel.org/stable/c/53e0db429b37a32b8fc706d0d90eb4583ad13848 Patch
https://git.kernel.org/stable/c/6eba92a4d4be8feb4dc33976abac544fa99d6ecc Patch
https://git.kernel.org/stable/c/7cf64d8679ca1cb20cf57d6a88bfee79a0922a66 Patch
https://git.kernel.org/stable/c/b9b34ddbe2076ade359cd5ce7537d5ed019e9807 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

09 Jan 2025, 15:00

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0e2dfdc74a7f4036127356d42ea59388f153f42c - () https://git.kernel.org/stable/c/0e2dfdc74a7f4036127356d42ea59388f153f42c - Patch
References () https://git.kernel.org/stable/c/2cfa537674cd1051a3b8111536d77d0558f33d5d - () https://git.kernel.org/stable/c/2cfa537674cd1051a3b8111536d77d0558f33d5d - Patch
References () https://git.kernel.org/stable/c/4d542ddb88fb2f39bf7f14caa2902f3e8d06f6ba - () https://git.kernel.org/stable/c/4d542ddb88fb2f39bf7f14caa2902f3e8d06f6ba - Patch
References () https://git.kernel.org/stable/c/53e0db429b37a32b8fc706d0d90eb4583ad13848 - () https://git.kernel.org/stable/c/53e0db429b37a32b8fc706d0d90eb4583ad13848 - Patch
References () https://git.kernel.org/stable/c/6eba92a4d4be8feb4dc33976abac544fa99d6ecc - () https://git.kernel.org/stable/c/6eba92a4d4be8feb4dc33976abac544fa99d6ecc - Patch
References () https://git.kernel.org/stable/c/7cf64d8679ca1cb20cf57d6a88bfee79a0922a66 - () https://git.kernel.org/stable/c/7cf64d8679ca1cb20cf57d6a88bfee79a0922a66 - Patch
References () https://git.kernel.org/stable/c/b9b34ddbe2076ade359cd5ce7537d5ed019e9807 - () https://git.kernel.org/stable/c/b9b34ddbe2076ade359cd5ce7537d5ed019e9807 - Patch
First Time Linux
Linux linux Kernel

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0e2dfdc74a7f4036127356d42ea59388f153f42c - () https://git.kernel.org/stable/c/0e2dfdc74a7f4036127356d42ea59388f153f42c -
References () https://git.kernel.org/stable/c/2cfa537674cd1051a3b8111536d77d0558f33d5d - () https://git.kernel.org/stable/c/2cfa537674cd1051a3b8111536d77d0558f33d5d -
References () https://git.kernel.org/stable/c/4d542ddb88fb2f39bf7f14caa2902f3e8d06f6ba - () https://git.kernel.org/stable/c/4d542ddb88fb2f39bf7f14caa2902f3e8d06f6ba -
References () https://git.kernel.org/stable/c/53e0db429b37a32b8fc706d0d90eb4583ad13848 - () https://git.kernel.org/stable/c/53e0db429b37a32b8fc706d0d90eb4583ad13848 -
References () https://git.kernel.org/stable/c/6eba92a4d4be8feb4dc33976abac544fa99d6ecc - () https://git.kernel.org/stable/c/6eba92a4d4be8feb4dc33976abac544fa99d6ecc -
References () https://git.kernel.org/stable/c/7cf64d8679ca1cb20cf57d6a88bfee79a0922a66 - () https://git.kernel.org/stable/c/7cf64d8679ca1cb20cf57d6a88bfee79a0922a66 -
References () https://git.kernel.org/stable/c/b9b34ddbe2076ade359cd5ce7537d5ed019e9807 - () https://git.kernel.org/stable/c/b9b34ddbe2076ade359cd5ce7537d5ed019e9807 -

28 Feb 2024, 14:06

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: corrige la lógica de negación de enmascaramiento en el registro dst negativo. La lógica de negación para el caso en el que off_reg se encuentra en el registro dst no es correcta, dado que entonces no podemos simplemente invertir la adición a un sub o viceversa. Como solución, realice la operación final bit a bit incondicionalmente en AX desde off_reg, luego mueva el puntero de src a dst y finalmente use AX como fuente para la operación aritmética del puntero original de modo que la inversión produzca un resultado correcto. El único movimiento que no sea AX en el medio es posible dado que el cegamiento constante lo retiene, ya que no es una operación inmediata.

27 Feb 2024, 19:04

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-27 19:04

Updated : 2025-01-09 15:00

NVD link : CVE-2021-46974

Mitre link : CVE-2021-46974

CVE.ORG link : CVE-2021-46974

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo