Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2021-46908: Linux kernel BPF could unintentionally expose data
CVE-2021-46908 · published 2 years ago
Summary
The Linux kernel’s BPF component had a logic error that could allow data to be exposed when mixing signed numbers. This issue is fixed by correcting the permission setting used during processing. Update the Linux kernel to the latest version to apply the fix.
What to do
- Update debian linux to version 5.10.38-1.
- Update linux linux to version 4f3ff11204eac0ee23acf64deecb3bad7b0db0c6 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux |
< 4f3ff11204eac0ee23acf64deecb3bad7b0db0c6 5.8 |
| – | linux | linux_kernel |
>= 5.8.0, < 5.10.32 >= 5.11.0, < 5.11.16 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Debian:12 | debian | linux |
< 5.10.38-1 Fix: upgrade to 5.10.38-1
|
Original advisory text
bpf: Use correct permission flag for mixed signed bounds arithmetic
In the Linux kernel, the following vulnerability has been resolved: bpf: Use correct permission flag for mixed signed bounds arithmetic We forbid adding unknown scalars with mixed signed bounds due to the spectre v1 masking mitigation. Hence this also needs bypass_spec_v1 flag instead of allow_ptr_leaks.
References
- https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51 Patch
- https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6 Patch
- https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be Patch
- https://security-tracker.debian.org/tracker/CVE-2021-46908 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.5
Medium
Timeline
Published27 Feb 2024
Updated4 Nov 2026
First seen4 Aug 2026
Track software like this
Free during beta