{"vulnerability": "CVE-2021-3144", "sightings": [{"uuid": "ee85d1c0-4760-4025-aa4c-8ef8200b88d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31440", "type": "published-proof-of-concept", "source": "https://t.me/k8security/306", "content": "\u0425\u043e\u0440\u043e\u0448\u0435\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044f\u0434\u0440\u0430 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF \u043f\u043e\u0434 \u043d\u043e\u043c\u0435\u0440\u043e\u043c CVE-2021-31440. \u0418\u0437 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0443\u0442 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d container escape \u0432 Kubernetes (Ubuntu 20.10, \u044f\u0434\u0440\u043e 5.8.0 \u0438 mikrok8s 1.20). \n\n\u0421\u0443\u0434\u044f \u043f\u043e \u0434\u0435\u043c\u043e \u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044e, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0441 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e\u0434\u043d\u044f\u043b\u0441\u044f \u0434\u043e root \u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f CAP_SYS_MODULE capability, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 \u0432\u043d\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430. \n\n\u041d\u0443 \u0430 \u0432\u0441\u0435 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043c\u043e\u0436\u043d\u043e \u0434\u0435\u043b\u0430\u0442\u044c \u043b\u044e\u0431\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432. \u0422\u0443\u0442 \u043b\u0438\u0431\u043e c\u0430\u043c\u0438 \u0445\u0430\u0440\u0434\u0435\u043d\u0438\u043c \u0438\u043b\u0438 \u0436\u0434\u0435\u043c \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f seccomp \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0438\u0441\u0430\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435. \u041d\u0443 \u0438, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, capability \u043d\u0443\u0436\u043d\u043e \u0442\u043e\u0436\u0435 \u0440\u0435\u0437\u0430\u0442\u044c.\n\nP.S. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0438 \u0437\u0430\u0432\u0442\u0440\u0430 \u044f \u043d\u0430 DevOpsConf 2021 \u0441 \u0434\u043e\u043a\u043b\u0430\u0434\u043e\u043c \u043f\u0440\u043e \"SecDevSecOpsSec\" - \u0431\u0443\u0434\u0443 \u0440\u0430\u0434 \u043f\u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u0441\u044f \u0438 \u043f\u043e\u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u043b\u0438\u0447\u043d\u043e AFK!\n\nP.S.S. \u041a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u0438 The Pirate Bay: \"In Real Life (IRL). We don't like that expression. We say AFK - Away From Keyboard. We think that the internet is for real.\"", "creation_timestamp": "2021-05-31T07:18:25.000000Z"}, {"uuid": "05b644d5-7399-41d8-a06d-30edbfd846e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31440", "type": "seen", "source": "Telegram/TXmZ8EBGvdc4uufvEqu6hfgyjEc7K_gjD1Jpp8Uzvu6-KK0", "content": "", "creation_timestamp": "2023-03-23T09:18:19.000000Z"}, {"uuid": "8c9231e2-f300-4688-ae30-890180ea6383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31440", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/1427", "content": "kernel-linux-factory\n*\n\u0423\u0434\u043e\u0431\u043d\u043e \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c \u0441\u0440\u0435\u0434\u0443, \u0433\u043b\u044f\u043d\u0443\u043b \u043a\u0430\u043a\u043e\u0435 \u044f\u0434\u0440\u043e, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043f\u043b\u043e\u0435\u0442, \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043f\u043e \u043c\u043e\u0440\u0434\u0435 #root\n*\n\u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 exploits \u0434\u043b\u044f:\nCVE-2016-9793\n4-20-BPF-integer\nCVE-2017-5123\nCVE-2017-6074\nCVE-2017-7308\nCVE-2017-8890\nCVE-2017-11176\nCVE-2017-16995\nCVE-2017-1000112\nCVE-2018-5333\nCVE-2019-9213 & CVE-2019-8956\nCVE-2019-15666\nCVE-2020-8835\nCVE-2020-27194\nCVE-2021-3156\nCVE-2021-31440\nCVE-2021-3490\nCVE-2021-22555\nCVE-2021-41073\nCVE-2021-4154\nCVE-2021-42008\nCVE-2021-43267\nCVE-2022-0185\nCVE-2022-0847\nCVE-2022-0995\nCVE-2022-1015\nCVE-2022-2588\nCVE-2022-2639\nCVE-2022-25636\nCVE-2022-27666\nCVE-2022-32250\nCVE-2022-34918\n\ndownload\n\n#linux #exploits #kernel", "creation_timestamp": "2023-03-23T06:30:43.000000Z"}, {"uuid": "cfbaeb27-a27b-4137-8354-c9f809fd7310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3144", "type": "seen", "source": "https://t.me/cibsecurity/24282", "content": "\u203c CVE-2021-3144 \u203c\n\nIn SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-27T07:40:10.000000Z"}, {"uuid": "f5adb905-ffda-4bf4-adcd-b111704cf075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31440", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3519", "content": "#exploit\n1. CVE-2021-30660:\nXNU Kernel Memory Disclosure\nhttps://alexplaskett.github.io/CVE-2021-30660\n\n2. CVE-2021-31440:\nAn Incorrect Bounds Calculation in the Linux Kernel EBPF Verifier (PoC)\nhttps://www.zerodayinitiative.com/blog/2021/5/26/cve-2021-31440-an-incorrect-bounds-calculation-in-the-linux-kernel-ebpf-verifier", "creation_timestamp": "2021-06-02T17:52:20.000000Z"}, {"uuid": "1e62dd24-47ae-4dcd-9008-36d0c4f41cdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31440", "type": "seen", "source": "https://t.me/cissp/3328", "content": "Cloud Security\n1. Metadata service MITM allows root privilege escalation (EKS/GKE)\nhttps://github.com/champtar/blog/blob/main/Metadata_MITM_root_EKS_GKE/README.md\n2. Detecting Obfuscated Attacker IPs in AWS\nhttps://www.hunters.ai/blog/hunters-research-detecting-obfuscated-attacker-ip-in-aws\n\nMalware analysis\n1. Malicious PowerShell Hosted on script-google-com\nhttps://isc.sans.edu/forums/diary/Malicious+PowerShell+Hosted+on+scriptgooglecom/27468\n2. Threat Actors Use Mockups of Popular Apps to Spread Teabot and Flubot Malware on Android\nhttps://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android\n\nRed Team Tactics\n1. Step-by-step how to deanonymize emails on LinkedIn\nhttps://www.gosecure.net/blog/2021/05/27/step-by-step-how-to-deanonymize-emails-on-linkedin\n2. Python AV Evasion Tools\nhttps://github.com/G1ft3dC0d3/MsfMania\n\nexploit\n1. CVE-2021-30660:\nXNU Kernel Memory Disclosure\nhttps://alexplaskett.github.io/CVE-2021-30660\n\n2. CVE-2021-31440:\nAn Incorrect Bounds Calculation in the Linux Kernel EBPF Verifier (PoC)\nhttps://www.zerodayinitiative.com/blog/2021/5/26/cve-2021-31440-an-incorrect-bounds-calculation-in-the-linux-kernel-ebpf-verifier", "creation_timestamp": "2026-09-01T17:00:49.514884Z"}, {"uuid": "3569e58e-3edb-4b3d-93b4-509b0ed99a98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31440", "type": "seen", "source": "https://t.me/cissp/3328", "content": "Cloud Security\n1. Metadata service MITM allows root privilege escalation (EKS/GKE)\nhttps://github.com/champtar/blog/blob/main/Metadata_MITM_root_EKS_GKE/README.md\n2. Detecting Obfuscated Attacker IPs in AWS\nhttps://www.hunters.ai/blog/hunters-research-detecting-obfuscated-attacker-ip-in-aws\n\nMalware analysis\n1. Malicious PowerShell Hosted on script-google-com\nhttps://isc.sans.edu/forums/diary/Malicious+PowerShell+Hosted+on+scriptgooglecom/27468\n2. Threat Actors Use Mockups of Popular Apps to Spread Teabot and Flubot Malware on Android\nhttps://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android\n\nRed Team Tactics\n1. Step-by-step how to deanonymize emails on LinkedIn\nhttps://www.gosecure.net/blog/2021/05/27/step-by-step-how-to-deanonymize-emails-on-linkedin\n2. Python AV Evasion Tools\nhttps://github.com/G1ft3dC0d3/MsfMania\n\nexploit\n1. CVE-2021-30660:\nXNU Kernel Memory Disclosure\nhttps://alexplaskett.github.io/CVE-2021-30660\n\n2. CVE-2021-31440:\nAn Incorrect Bounds Calculation in the Linux Kernel EBPF Verifier (PoC)\nhttps://www.zerodayinitiative.com/blog/2021/5/26/cve-2021-31440-an-incorrect-bounds-calculation-in-the-linux-kernel-ebpf-verifier", "creation_timestamp": "2026-09-02T01:04:37.684760Z"}]}