CVE-2021-3490: Linux Kernel eBPF ALU32 RCE Vulnerability

CVE-2021-3490 Overview

CVE-2021-3490 is a critical vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem that affects ALU32 bounds tracking for bitwise operations. The vulnerability occurs when the kernel verifier fails to properly update 32-bit bounds during AND, OR, and XOR operations, allowing attackers to manipulate eBPF programs to perform out-of-bounds reads and writes in kernel memory. This flaw can be exploited by a local attacker with unprivileged access to load eBPF programs to achieve arbitrary code execution with elevated privileges.

Critical Impact

Local privilege escalation vulnerability allowing unprivileged users to gain root access through eBPF program manipulation, enabling complete system compromise.

Affected Products

• Linux Kernel versions 5.7-rc1 through 5.12.3 (AND/OR operations)
• Linux Kernel versions 5.10-rc1 through 5.12.3 (XOR operation)
• Canonical Ubuntu Linux 20.04 LTS, 20.10, and 21.04

Discovery Timeline

• 2021-05-11 - Vulnerability disclosed via Openwall OSS-Security Discussion
• 2021-06-04 - CVE CVE-2021-3490 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3490

Vulnerability Analysis

This vulnerability resides in the eBPF verifier component of the Linux kernel, specifically within the ALU32 bounds tracking logic. The eBPF verifier is responsible for ensuring that eBPF programs loaded by users cannot harm the kernel or access unauthorized memory regions. The flaw was introduced when explicit ALU32 bounds tracking was added for bitwise operations in commit 3f50f132d840 (kernel 5.7-rc1). The XOR variant was later introduced in commit 2921c90d4718 (kernel 5.10-rc1).

When processing 32-bit bitwise AND, OR, and XOR operations, the verifier incorrectly calculates the resulting bounds of register values. An attacker can craft a malicious eBPF program that exploits this miscalculation to convince the verifier that a register holds a value within safe bounds, when in reality the value can be outside those bounds at runtime. This discrepancy allows the attacker to perform memory accesses that bypass the verifier's safety checks, ultimately enabling out-of-bounds reads and writes in kernel memory space.

Root Cause

The root cause is improper input validation (CWE-20) combined with an out-of-bounds read condition (CWE-125) in the eBPF verifier's bounds tracking logic. When the verifier performs abstract interpretation of 32-bit bitwise operations, it fails to correctly account for how these operations affect the upper and lower bounds of register values. The verifier's model of register states diverges from actual runtime behavior, creating a window for exploitation. This type confusion between the verifier's view and actual register values enables attackers to craft programs that pass verification but violate memory safety guarantees at execution time.

Attack Vector

The attack requires local access and the ability to load eBPF programs. On systems where unprivileged eBPF is enabled (controlled by /proc/sys/kernel/unprivileged_bpf_disabled), any local user can attempt exploitation. The attacker constructs an eBPF program containing carefully crafted 32-bit bitwise operations that exploit the bounds tracking flaw.

The exploitation flow involves:

1. Loading a malicious eBPF program that passes the flawed verifier checks
2. Triggering the eBPF program to execute operations that the verifier incorrectly validated
3. Using the resulting out-of-bounds memory access to read or write arbitrary kernel memory
4. Leveraging kernel memory corruption to escalate privileges, typically by overwriting credential structures or function pointers

The vulnerability has been documented and analyzed with exploit code available via Packet Storm Exploit Analysis. Additional technical details are available through the Zero Day Initiative Advisory ZDI-21-606.

Detection Methods for CVE-2021-3490

Indicators of Compromise

• Unusual eBPF program loading activity from unprivileged user accounts
• Unexpected privilege escalation events or unauthorized root access
• Kernel panic or system instability following eBPF program execution
• Anomalous memory access patterns detected in kernel audit logs

Detection Strategies

• Monitor /proc/sys/kernel/unprivileged_bpf_disabled status and alert if unprivileged eBPF is enabled on production systems
• Implement kernel auditing to track bpf() syscall invocations by non-root users
• Deploy endpoint detection solutions capable of identifying eBPF-based privilege escalation attempts
• Enable BPF audit logging via bpf_jit_enable and bpf_jit_kallsyms sysctl options for forensic analysis

Monitoring Recommendations

• Configure auditd rules to monitor eBPF program loading: auditctl -a always,exit -F arch=b64 -S bpf
• Monitor for unexpected processes gaining root privileges without standard authentication
• Track kernel module loading and unusual kernel memory access patterns
• Implement file integrity monitoring on critical system binaries and kernel modules

How to Mitigate CVE-2021-3490

Immediate Actions Required

• Update Linux kernel to patched versions: v5.12.4, v5.11.21, v5.10.37, or v5.13-rc4+
• Disable unprivileged eBPF by setting /proc/sys/kernel/unprivileged_bpf_disabled to 1 or 2
• Apply Ubuntu security patches via USN-4949-1 or USN-4950-1
• Review system logs for any signs of prior exploitation attempts

Patch Information

The vulnerability was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations"). The fix properly updates 32-bit bounds when performing bitwise AND, OR, and XOR operations in the eBPF verifier. The patch has been backported to stable kernel releases v5.12.4, v5.11.21, and v5.10.37. Organizations should apply these updates immediately through their standard kernel update procedures. The official patch can be reviewed at the Linux Kernel BPF Commit. Additional vendor-specific patches are available through NetApp Security Advisory for affected NetApp products.

Workarounds

• Disable unprivileged eBPF access to prevent exploitation by non-root users
• Apply mandatory access control policies (SELinux/AppArmor) to restrict eBPF capabilities
• Limit user access to systems running vulnerable kernels until patches are applied
• Consider kernel lockdown mode on critical systems to restrict kernel modification capabilities

# Disable unprivileged eBPF to mitigate exploitation
echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled

# Make the change persistent across reboots
echo "kernel.unprivileged_bpf_disabled = 1" >> /etc/sysctl.d/99-bpf-hardening.conf
sysctl -p /etc/sysctl.d/99-bpf-hardening.conf

# Verify the setting is applied
sysctl kernel.unprivileged_bpf_disabled