CVE-2021-3491
Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
El subsistema io_uring del kernel de Linux permitía saltarse el límite MAX_RW_COUNT en la operación PROVIDE_BUFFERS, lo que llevaba a utilizar valores negativos en mem_rw al leer /proc//mem. Esto podía utilizarse para crear un desbordamiento de la pila que conducía a la ejecución de código arbitrario en el kernel. Se solucionó mediante el commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) y se retroalimentó a los kernels estables en versiones v5.12.4, v5.11.21 y v5.10.37. Se introdujo en ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
This vulnerability allows local attackers to escalate privileges on affected installations of Canonical Ubuntu. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of buffers in io_uring. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before accessing memory. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-04-09 CVE Reserved
- 2021-05-12 CVE Published
- 2023-03-08 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-131: Incorrect Calculation of Buffer Size
- CWE-787: Out-of-bounds Write
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20210716-0004 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-21-589 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://ubuntu.com/security/notices/USN-4949-1 | 2021-09-14 | |
| https://ubuntu.com/security/notices/USN-4950-1 | 2021-09-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.7 < 5.10.37 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.7 < 5.10.37" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.11 < 5.11.21 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.11 < 5.11.21" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.12 < 5.12.4 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.12 < 5.12.4" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 20.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "20.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 20.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "20.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 21.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "21.04" | - |
Affected
| ||||||