CVE-2021-38300

Name
CVE-2021-38300
Description
arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC http://www.openwall.com/lists/oss-security/2021/09/15/5
CONFIRM https://security.netapp.com/advisory/ntap-20211008-0003/
CONFIRM https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
CONFIRM https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
Third Party Advisory https://www.debian.org/security/2022/dsa-5096
Third Party Advisory https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* linux_kernel >= None <= 5.14.6
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* linux_kernel >= None < 5.14.10

Vulnerable and fixed packages

Source package Branch Version Maintainer Status