CVE-2021-47607·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg The implementation of BPF_CMPXCHG on a high level has the following parameters: .-[old-val] .-[new-val] BPF_R0 = cmpxchg{32,64}(DST_REG + insn->off, BPF_R0, SRC_REG) `-[mem-loc] `-[old-val] Given a BPF insn can only have two registers (dst, src), the R0 is fixed and used as an auxilliary register for input (old value) as well as output (returning old value from memory location). While the verifier performs a number of safety checks, it misses to reject unprivileged programs where R0 contains a pointer as old value. Through brute-forcing it takes about ~16sec on my machine to leak a kernel pointer with BPF_CMPXCHG. The PoC is basically probing for kernel addresses by storing the guessed address into the map slot as a scalar, and using the map value pointer as R0 while SRC_REG has a canary value to detect a matching address. Fix it by checking R0 for pointers, and reject if that's the case for unprivileged programs.
- Severity
- medium
- Software
- Kernel
- Fixed in
- 5.15.11
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 5% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 5.12
Until: 5.15.11
Fixed in: 5.15.11
How to fix this CVE
Update your Linux kernel to version 5.15.11 or later to patch a BPF verifier vulnerability that allows unprivileged users to leak kernel memory addresses. This issue affects kernel versions 5.12 through 5.15.10 and requires immediate patching on systems where unprivileged BPF programs are permitted. Prioritize this update for production environments to prevent potential privilege escalation attacks.
sudo dnf update kernel kernel-develDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check your current kernel version with `uname -r` and verify if it falls within 5.12.x to 5.15.10 range
- Step 2: Verify if unprivileged BPF programs are enabled by checking `sysctl kernel.unprivileged_bpf_disabled` (0 means enabled/vulnerable)
- Step 3: Search kernel logs for BPF-related errors using `dmesg | grep -i bpf` to detect any attempted exploitations
- Step 4: After patching, confirm the new kernel version with `uname -r` and reboot to activate the fix with `sudo reboot`
FAQ
What is CVE-2021-47607?
This is a kernel BPF verifier bypass that allows unprivileged users to leak kernel memory addresses through the BPF_CMPXCHG instruction, which failed to properly validate pointer values stored in the R0 auxiliary register.
Is CVE-2021-47607 being actively exploited?
No, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available, though proof-of-concept code has been demonstrated.
What versions of Kernel are affected by CVE-2021-47607?
Linux kernel versions 5.12.0 through 5.15.10 are vulnerable; version 5.15.11 and later contain the fix.
How do I check if my server is vulnerable to CVE-2021-47607?
Run `uname -r` to get your kernel version and compare it against the affected range (5.12 to 5.15.10), then check `sysctl kernel.unprivileged_bpf_disabled` to see if unprivileged BPF is enabled.
Does Defensia detect CVE-2021-47607?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If the Linux kernel is installed on a monitored server within the vulnerable version range, CVE-2021-47607 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2021-47607. Free for 1 server.
Get started free