CVE-2021-38166 Overview
CVE-2021-38166 is an integer overflow and out-of-bounds write vulnerability in kernel/bpf/hashtab.c within the Linux kernel. The flaw affects Linux kernel versions through 5.13.8 and triggers when many elements are placed in a single hash bucket. A local attacker with sufficient privileges can leverage the overflow to corrupt kernel memory. Exploitation requires the CAP_SYS_ADMIN capability, which limits the practical attack surface to privileged contexts or container escapes from misconfigured environments. The vulnerability impacts Linux distributions including Fedora 33, Fedora 34, and Debian 11.
Critical Impact
A local user with CAP_SYS_ADMIN can trigger an out-of-bounds kernel write through the BPF hashtab subsystem, leading to memory corruption, privilege escalation, or kernel crash.
Affected Products
- Linux Kernel through version 5.13.8
- Fedora 33 and Fedora 34
- Debian Linux 11.0
Discovery Timeline
- 2021-08-07 - CVE-2021-38166 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2021-38166
Vulnerability Analysis
The vulnerability resides in the Berkeley Packet Filter (BPF) hash table implementation in kernel/bpf/hashtab.c. The BPF hashtab subsystem manages key-value maps used by eBPF programs for storing and retrieving data at kernel runtime. When many elements are inserted into a single bucket, an integer overflow occurs during size calculations. The overflow causes the kernel to allocate an undersized buffer, which is then followed by an out-of-bounds write when subsequent elements are stored.
The weakness is categorized as [CWE-190] Integer Overflow or Wraparound. Successful exploitation can corrupt adjacent kernel heap structures, enabling privilege escalation or denial of service through kernel panic. Because the BPF subsystem runs in kernel context, any memory corruption directly affects the integrity of the running kernel.
Root Cause
The root cause is unchecked arithmetic in size computations for hash bucket storage. When the element count or size multiplier wraps around the integer boundary, the resulting allocation is smaller than required. Subsequent writes exceed the allocated region, corrupting neighboring kernel memory. The upstream fix is tracked in commit c4eb1f403243fc7bbb7de644db8587c03de36da6 in the BPF kernel tree.
Attack Vector
The attack requires local access and the CAP_SYS_ADMIN capability. An attacker loads a crafted eBPF program or interacts with BPF map syscalls to populate a hash table with a large number of elements colliding into a single bucket. The bucket size calculation overflows, allocation underflows, and a controlled out-of-bounds write follows. In containerized environments where CAP_SYS_ADMIN is granted improperly, this flaw becomes a viable container escape primitive.
No verified public proof-of-concept code is available. See the BPF Mailing List Discussion for technical context.
Detection Methods for CVE-2021-38166
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing hashtab.c or BPF map operations in dmesg or /var/log/kern.log.
- Unprivileged processes attempting bpf() syscalls with BPF_MAP_CREATE or BPF_MAP_UPDATE_ELEM at high frequency.
- Containers or workloads unexpectedly holding the CAP_SYS_ADMIN capability.
Detection Strategies
- Audit bpf() syscall usage with auditd rules to identify programs creating large BPF hash maps.
- Inspect kernel ring buffer output for BPF-related memory corruption signatures or unexpected slab allocator warnings.
- Correlate process capability sets with syscall activity to flag non-root processes wielding CAP_SYS_ADMIN.
Monitoring Recommendations
- Continuously monitor running kernel versions across the fleet and flag hosts running Linux kernels prior to the patched release.
- Track container security policies to ensure CAP_SYS_ADMIN is not granted unless required.
- Alert on kernel crash dumps that reference BPF subsystem stack frames for forensic review.
How to Mitigate CVE-2021-38166
Immediate Actions Required
- Apply vendor-supplied kernel updates from Debian DSA-4978 and the relevant Fedora package advisories.
- Restrict CAP_SYS_ADMIN in container runtimes and seccomp profiles to limit BPF map creation by untrusted workloads.
- Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading eBPF programs.
Patch Information
The upstream fix is committed to the BPF kernel tree as c4eb1f403243fc7bbb7de644db8587c03de36da6. See the Linux Kernel BPF Commit for the patch. Distribution-specific updates are available via the Debian Security Advisory DSA-4978 and the Fedora package announcements. The NetApp Security Advisory lists affected NetApp products.
Workarounds
- Disable unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1.
- Remove CAP_SYS_ADMIN from container security contexts using Kubernetes Pod Security Standards or Docker --cap-drop.
- Apply Linux Security Module policies (SELinux, AppArmor) to restrict access to the bpf() syscall.
# Configuration example - disable unprivileged BPF and audit usage
sysctl -w kernel.unprivileged_bpf_disabled=1
echo "kernel.unprivileged_bpf_disabled=1" >> /etc/sysctl.d/90-bpf-hardening.conf
# auditd rule to log bpf() syscall invocations
echo "-a always,exit -F arch=b64 -S bpf -k bpf_syscall" >> /etc/audit/rules.d/bpf.rules
auditctl -R /etc/audit/rules.d/bpf.rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
