Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-34866
HistoryJan 25, 2022 - 12:00 a.m.

CVE-2021-34866

2022-01-2500:00:00
ubuntu.com
ubuntu.com
33
linux kernel 5.14-rc3
local attackers
privilege escalation
ebpf programs
type confusion
arbitrary code
zdi-can-14689
security vulnerability

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

23.1%

This vulnerability allows local attackers to escalate privileges on
affected installations of Linux Kernel 5.14-rc3. An attacker must first
obtain the ability to execute low-privileged code on the target system in
order to exploit this vulnerability. The specific flaw exists within the
handling of eBPF programs. The issue results from the lack of proper
validation of user-supplied eBPF programs, which can result in a type
confusion condition. An attacker can leverage this vulnerability to
escalate privileges and execute arbitrary code in the context of the
kernel. Was ZDI-CAN-14689.

OSVersionArchitecturePackageVersionFilename
ubuntu21.04noarchlinux< 5.11.0-38.42UNKNOWN
ubuntu21.04noarchlinux-aws< 5.11.0-1020.21UNKNOWN
ubuntu20.04noarchlinux-aws-5.11< 5.11.0-1020.21~20.04.2UNKNOWN
ubuntu21.04noarchlinux-azure< 5.11.0-1020.21UNKNOWN
ubuntu20.04noarchlinux-azure-5.11< 5.11.0-1020.21~20.04.1UNKNOWN
ubuntu21.04noarchlinux-gcp< 5.11.0-1021.23UNKNOWN
ubuntu20.04noarchlinux-gcp-5.11< 5.11.0-1021.23~20.04.1UNKNOWN
ubuntu20.04noarchlinux-hwe-5.11< 5.11.0-38.42~20.04.1UNKNOWN
ubuntu21.04noarchlinux-kvm< 5.11.0-1018.19UNKNOWN
ubuntu20.04noarchlinux-oem-5.10< 5.10.0-1050.52UNKNOWN
Rows per page:
1-10 of 161

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

23.1%