Vulnerability Description
A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | < 5.7 |
| Redhat | Enterprise Linux | 8.0 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2021-4159Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2036024Issue Tracking
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=29Mailing ListPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00000.htmlMailing ListThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-4159Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-4159Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2036024Issue Tracking
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=29Mailing ListPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00000.htmlMailing ListThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-4159Third Party Advisory
FAQ
What is CVE-2021-4159?
CVE-2021-4159 is a vulnerability with a CVSS score of 4.4 (MEDIUM). A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to...
How severe is CVE-2021-4159?
CVE-2021-4159 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-4159?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Redhat Enterprise Linux, Debian Debian Linux.