CVE-2021-29154: Linux Kernel BPF JIT RCE Vulnerability

CVE-2021-29154 Overview

CVE-2021-29154 is a critical vulnerability in the BPF (Berkeley Packet Filter) JIT (Just-In-Time) compilers within the Linux kernel through version 5.11.12. The vulnerability stems from incorrect computation of branch displacements in the x86 architecture BPF JIT compiler, allowing attackers with local access to execute arbitrary code within the kernel context. This affects the files arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.

Critical Impact

Local privilege escalation to kernel-level code execution, potentially allowing complete system compromise through BPF program manipulation.

Affected Products

• Linux Kernel (through version 5.11.12)
• Fedora 33
• Debian Linux 9.0
• NetApp Cloud Backup
• NetApp HCI Management Node
• NetApp SolidFire
• NetApp H-Series firmware and hardware (H300S, H500S, H700S, H300E, H500E, H700E, H410S)

Discovery Timeline

• April 8, 2021 - CVE-2021-29154 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-29154

Vulnerability Analysis

The BPF JIT compiler in the Linux kernel is responsible for translating BPF bytecode into native machine instructions for improved performance. This vulnerability exists because the JIT compiler incorrectly calculates branch displacement values when generating x86 native code from BPF programs.

Branch displacements are offset values used in jump instructions to determine the target address of a branch. When these values are computed incorrectly, the generated machine code may jump to unintended memory locations. An attacker who can craft and load a malicious BPF program can exploit this miscalculation to redirect execution flow to attacker-controlled code, achieving arbitrary code execution with kernel privileges.

The vulnerability affects both 32-bit and 64-bit x86 architectures, as evidenced by the impacted files bpf_jit_comp.c (64-bit) and bpf_jit_comp32.c (32-bit). Since BPF programs run within the kernel context, successful exploitation grants the attacker complete control over the system.

Root Cause

The root cause is a command injection vulnerability (CWE-77) in the branch displacement calculation logic within the BPF JIT compilation process. The compiler fails to properly validate or compute the relative offsets for conditional and unconditional branch instructions, leading to incorrect native code generation. This arithmetic error in displacement calculation allows crafted BPF programs to manipulate the generated jump targets.

Attack Vector

The attack requires local access to the target system and the ability to load BPF programs. On many Linux distributions, unprivileged users can load BPF programs by default, making this vulnerability exploitable without elevated privileges initially. The attack flow involves:

1. An attacker crafts a malicious BPF program with specific instruction sequences designed to trigger the branch displacement miscalculation
2. The attacker loads the BPF program through the bpf() system call
3. The kernel JIT compiles the BPF bytecode into native x86 instructions with incorrect branch offsets
4. When the BPF program executes, the malformed branch instructions redirect execution to attacker-controlled memory
5. The attacker achieves arbitrary kernel code execution and complete system compromise

The vulnerability mechanism involves the JIT compiler generating incorrect relative offset values for jump instructions. When the BPF program contains specific patterns of conditional branches, the displacement calculation overflow or underflow results in jumps that target memory outside the intended BPF program boundaries. Attackers can leverage this to redirect control flow to carefully positioned shellcode or ROP gadgets. For detailed technical analysis, refer to the OpenWall OSS-Security Discussion.

Detection Methods for CVE-2021-29154

Indicators of Compromise

• Unusual BPF program loading activity from unprivileged users or unexpected processes
• Kernel crash logs or oops messages indicating memory corruption in BPF-related code paths
• Suspicious activity following BPF program execution, such as privilege escalation or unauthorized kernel module loading
• Audit logs showing excessive or anomalous bpf() system calls

Detection Strategies

• Monitor bpf() system calls using auditd rules to detect suspicious BPF program loading activity
• Deploy kernel integrity monitoring solutions to detect unauthorized kernel memory modifications
• Implement SentinelOne's behavioral analysis to identify exploitation attempts targeting the BPF subsystem
• Review system logs for kernel warnings or errors related to JIT compilation failures

Monitoring Recommendations

• Enable kernel auditing for BPF-related operations with rules targeting bpf system calls
• Configure alerts for unexpected privilege escalation events, especially those following BPF activity
• Monitor for processes attempting to load BPF programs that do not typically require BPF functionality
• Deploy runtime application self-protection (RASP) solutions to detect kernel exploitation attempts

How to Mitigate CVE-2021-29154

Immediate Actions Required

• Update the Linux kernel to a patched version that addresses the branch displacement calculation error
• Disable unprivileged BPF by setting kernel.unprivileged_bpf_disabled=1 via sysctl
• Restrict BPF program loading capabilities using seccomp filters or SELinux/AppArmor policies
• Apply vendor-specific patches from Debian, Fedora, or NetApp as applicable to your environment

Patch Information

The Linux kernel maintainers have released patches addressing this vulnerability. The fixes are available through the following commits:

• Linux Kernel Commit 26f55a5 - Primary fix for the branch displacement calculation
• Linux Kernel Commit e4d4d45 - Additional corrections

Distribution-specific advisories are available from Debian LTS, Fedora, and NetApp Security Advisory. A Kernel Live Patch is also available for systems requiring minimal downtime.

Workarounds

• Disable unprivileged BPF access system-wide using the sysctl parameter below
• Disable the BPF JIT compiler entirely by setting net.core.bpf_jit_enable=0 (impacts performance)
• Use container isolation with restricted capabilities that prevent BPF program loading
• Implement mandatory access control (MAC) policies to limit which processes can invoke BPF operations

# Configuration example
# Disable unprivileged BPF access (recommended mitigation)
echo "kernel.unprivileged_bpf_disabled=1" >> /etc/sysctl.d/99-bpf-hardening.conf

# Optionally disable BPF JIT compiler entirely (performance impact)
echo "net.core.bpf_jit_enable=0" >> /etc/sysctl.d/99-bpf-hardening.conf

# Apply changes immediately
sysctl -p /etc/sysctl.d/99-bpf-hardening.conf

# Verify settings
sysctl kernel.unprivileged_bpf_disabled
sysctl net.core.bpf_jit_enable