CVE-2021-3490

highPriorität · beachten · 51EPSS 0.274 · 98. PerzentilExploit · waffenfähigEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

6 exploits · waffenfähig

Likely / severe?

27.4% (98th) EPSS

CVSS 7.2 · high

Is it mine?

27 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 10

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · security@ubuntu.comAusnutzbarkeit 1.1 · Auswirkung 6

v3.17.6highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Fsecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-125USprimärCWE-787USprimärCWE-125USCWE-20USCWE-20USCWE-787US

Exploits (6)

Öffentlicher Proof-of-Concept- und Exploit-Code.

exploit/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpeLinux eBPF ALU32 32-bit Invalid Bounds Tracking LPEwaffenfähig · metasploit
WhatsWrongAndWhy/CVE-2021-3490WhatsWrongAndWhy/CVE-2021-3490PoC · poc_in_github
chompie1337/Linux_LPE_eBPF_CVE-2021-3490chompie1337/Linux_LPE_eBPF_CVE-2021-3490PoC · poc_in_github
pivik271/CVE-2021-3490pivik271/CVE-2021-3490PoC · poc_in_github
prabeershakya/CVE-2021-3490-POCprabeershakya/CVE-2021-3490-POCPoC · poc_in_github
sandesh9978/cve-2021-3490-ebpf-analysisResearch implementation demonstrating interaction with Linux eBPF subsystem related to CVE-2021-3490. Includes BPF map creation, syscall wrappers, namespace setup, and verifier analysis. For educational and security research purposes only.PoC · poc_in_github

betroffene Produkte (27)

Betroffene Produkte und Versionsbereiche.

Linux Linux kernellinux-5.10.y → v5.10.37enisa_euvdEU
Linux Linux kernellinux-5.11.y → v5.11.21enisa_euvdEU
Linux Linux kernellinux-5.12.y → v5.12.4enisa_euvdEU
Linux Linux kerneltrunk → v5.13-rc4enisa_euvdEU
Linux Linux kernelv5.7-rc1 → 5.7*enisa_euvdEU
Canonical Ltd. Ubuntu≤ 20.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 20.10fstec_bduRU
Canonical Ltd. Ubuntu≤ 21.04fstec_bduRU
Fedora Project Fedora≤ 34fstec_bduRU
Fedora Project Fedora≤ 33fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.3fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.4fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
Сообщество свободного программного обеспечения Linux5.11.0 → 5.11.20fstec_bduRU
Сообщество свободного программного обеспечения Linux5.12.0 → 5.12.3fstec_bduRU
Сообщество свободного программного обеспечения Linux5.7 → 5.10.36fstec_bduRU

20 von 27 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

PUB-A-1908766662021-10-01vendor · osvUS
In scalar32_min_max_and and related functions of verifier.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv NVD CVE.org MITRE

veröffentlicht 2021-06-04geändert 2026-06-17

verwandt (27,239)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-86950US	—OT kritisch	26.2% (98th)	KEV	2026-09-28
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1,…
CVE-2026-87491US	—OT kritisch	3.51% (89th)	KEV	2026-09-09
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security…
CVE-2026-53362US	—OT kritisch	0.71% (53rd)	KEV	2026-07-04
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branc…
CVE-2026-53266US	—OT kritisch	0.93% (61st)	KEV	2026-06-25
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source addre…
CVE-2026-11645US	—OT kritisch	2.44% (84th)	KEV	2026-06-09
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…

+27234 weitere

Referenzen (32)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan