GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-46908 (GCVE-0-2021-46908)

Vulnerability from cvelistv5 – Published: 2024-02-27 06:53 – Updated: 2026-08-05 08:44
VLAI
Title
bpf: Use correct permission flag for mixed signed bounds arithmetic
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Use correct permission flag for mixed signed bounds arithmetic We forbid adding unknown scalars with mixed signed bounds due to the spectre v1 masking mitigation. Hence this also needs bypass_spec_v1 flag instead of allow_ptr_leaks.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 15:41 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366 , < 4f3ff11204eac0ee23acf64deecb3bad7b0db0c6 (git)
Affected: 2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366 , < 4ccdc6c6cae38b91c871293fb0ed8c6845a61b51 (git)
Affected: 2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366 , < 9601148392520e2e134936e76788fc2a6371e7be (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.32 , ≤ 5.10.* (semver)
Unaffected: 5.11.16 , ≤ 5.11.* (semver)
Unaffected: 5.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46908",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-27T15:41:34.586719Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:12.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:43.036Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4f3ff11204eac0ee23acf64deecb3bad7b0db0c6",
              "status": "affected",
              "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
              "versionType": "git"
            },
            {
              "lessThan": "4ccdc6c6cae38b91c871293fb0ed8c6845a61b51",
              "status": "affected",
              "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
              "versionType": "git"
            },
            {
              "lessThan": "9601148392520e2e134936e76788fc2a6371e7be",
              "status": "affected",
              "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.32",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.16",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use correct permission flag for mixed signed bounds arithmetic\n\nWe forbid adding unknown scalars with mixed signed bounds due to the\nspectre v1 masking mitigation. Hence this also needs bypass_spec_v1\nflag instead of allow_ptr_leaks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in the BPF verifier (adjust_ptr_min_max_vals), reached only via the local bpf() syscall when loading a program (e.g. SOCKET_FILTER), not via network packet processing.\nAC:L - An attacker can reliably craft and load a BPF program with mixed signed-bounds pointer arithmetic on PTR_TO_MAP_VALUE; no race or external environmental condition beyond the attacker\u0027s control is required to reach the buggy check. Unprivileged users can load BPF_PROG_TYPE_SOCKET_FILTER/CGROUP_SKB when kernel.unprivileged_bpf_disabled is 0 (upstream default throughout the 5.8\u20135.11 affected range), which exercises this verifier path without CAP_BPF or CAP_PERFMON. An attacker can reliably craft and load a BPF program with mixed signed-bounds pointer arithmetic on PTR_TO_MAP_VALUE; no race or external environmental condition beyond the attacker\u0027s control is required to reach the buggy check.\nPR:L - Unprivileged users can load BPF_PROG_TYPE_SOCKET_FILTER/CGROUP_SKB when kernel.unprivileged_bpf_disabled is 0 (upstream default throughout the 5.8\u20135.11 affected range), which exercises this verifier path without CAP_BPF or CAP_PERFMON.\nUI:N - Exploitation requires only the attacker loading their own BPF program; no victim action is needed.\nS:U - Impact stays within the kernel\u0027s security authority (local speculative disclosure of kernel memory); this is not a VM/IOMMU/sandbox boundary crossing.\nC:H - The check exists specifically for Spectre v1 masking of map-value pointer arithmetic; bypassing it enables speculative out-of-bounds access that can disclose arbitrary kernel memory via side channels, matching other BPF Spectre CVEs.\nI:N - This is a speculative-execution mitigation gap; architectural verifier bounds still apply and speculative effects do not commit writes, so integrity is not impacted.\nA:H - Same-series BPF Spectre sanitation bugs (e.g. CVE-2020-27171) and existing assessments of this CVE treat failed/incorrect ALU sanitation as potentially crashing the kernel; under the overestimate rule A:H is the higher-severity choice."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:44:59.893Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51"
        },
        {
          "url": "https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be"
        }
      ],
      "title": "bpf: Use correct permission flag for mixed signed bounds arithmetic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46908",
    "datePublished": "2024-02-27T06:53:49.541Z",
    "dateReserved": "2024-02-25T13:45:52.718Z",
    "dateUpdated": "2026-08-05T08:44:59.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-46908",
      "date": "2026-09-19",
      "epss": "0.00241",
      "percentile": "0.15532"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DE87B38C-0350-471A-8830-58E1E02F7E2E",
                  "versionEndExcluding": "5.10.32",
                  "versionStartIncluding": "5.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3C5242B9-B5BD-4578-AD66-69DF59D54A14",
                  "versionEndExcluding": "5.11.16",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use correct permission flag for mixed signed bounds arithmetic\n\nWe forbid adding unknown scalars with mixed signed bounds due to the\nspectre v1 masking mitigation. Hence this also needs bypass_spec_v1\nflag instead of allow_ptr_leaks."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bpf: use el indicador de permiso correcto para aritm\u00e9tica de los l\u00edmites con signo mixto Prohibimos agregar escalares desconocidos con l\u00edmites con signo mixto debido a la mitigaci\u00f3n de enmascaramiento de Spectre v1. Por lo tanto, esto tambi\u00e9n necesita el indicador bypass_spec_v1 en lugar de enable_ptr_leaks."
        }
      ],
      "id": "CVE-2021-46908",
      "lastModified": "2024-11-21T06:34:54.460",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-02-27T07:15:06.977",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4f3ff11204eac0ee23acf64deecb3bad7b0db0c6",
                    "status": "affected",
                    "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ccdc6c6cae38b91c871293fb0ed8c6845a61b51",
                    "status": "affected",
                    "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9601148392520e2e134936e76788fc2a6371e7be",
                    "status": "affected",
                    "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.8"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.32",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.11.*",
                    "status": "unaffected",
                    "version": "5.11.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DE87B38C-0350-471A-8830-58E1E02F7E2E",
                    "versionEndExcluding": "5.10.32",
                    "versionStartIncluding": "5.8.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3C5242B9-B5BD-4578-AD66-69DF59D54A14",
                    "versionEndExcluding": "5.11.16",
                    "versionStartIncluding": "5.11.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use correct permission flag for mixed signed bounds arithmetic\n\nWe forbid adding unknown scalars with mixed signed bounds due to the\nspectre v1 masking mitigation. Hence this also needs bypass_spec_v1\nflag instead of allow_ptr_leaks."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bpf: use el indicador de permiso correcto para aritm\u00e9tica de los l\u00edmites con signo mixto Prohibimos agregar escalares desconocidos con l\u00edmites con signo mixto debido a la mitigaci\u00f3n de enmascaramiento de Spectre v1. Por lo tanto, esto tambi\u00e9n necesita el indicador bypass_spec_v1 en lugar de enable_ptr_leaks."
          }
        ],
        "id": "CVE-2021-46908",
        "lastModified": "2026-08-04T10:16:35.773",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-46908",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-27T15:41:34.586719Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-27T07:15:06.977",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T21:36:16+00:00",
      "cve": "CVE-2021-46908",
      "id": "CVE-2021-46908",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: unknown scalars with mixed signed bounds masking mitigation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-46908.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-18T00:27:43Z",
      "cve": "CVE-2021-46908",
      "id": "CVE-2021-46908",
      "initial_release_date": "2024-02-28T04:02:22Z",
      "product_status:known_not_affected": "276",
      "product_status:recommended": "85",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-46908",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-46908.json",
      "version": "25"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:17:43.036Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-46908",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-02-27T15:41:34.586719Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:13.366Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "kernel/bpf/verifier.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "4f3ff11204eac0ee23acf64deecb3bad7b0db0c6",
                  "status": "affected",
                  "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
                  "versionType": "git"
                },
                {
                  "lessThan": "4ccdc6c6cae38b91c871293fb0ed8c6845a61b51",
                  "status": "affected",
                  "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
                  "versionType": "git"
                },
                {
                  "lessThan": "9601148392520e2e134936e76788fc2a6371e7be",
                  "status": "affected",
                  "version": "2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "kernel/bpf/verifier.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.8"
                },
                {
                  "lessThan": "5.8",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.32",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.11.*",
                  "status": "unaffected",
                  "version": "5.11.16",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.32",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.11.16",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use correct permission flag for mixed signed bounds arithmetic\n\nWe forbid adding unknown scalars with mixed signed bounds due to the\nspectre v1 masking mitigation. Hence this also needs bypass_spec_v1\nflag instead of allow_ptr_leaks."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable code is in the BPF verifier (adjust_ptr_min_max_vals), reached only via the local bpf() syscall when loading a program (e.g. SOCKET_FILTER), not via network packet processing.\nAC:L - An attacker can reliably craft and load a BPF program with mixed signed-bounds pointer arithmetic on PTR_TO_MAP_VALUE; no race or external environmental condition beyond the attacker\u0027s control is required to reach the buggy check. Unprivileged users can load BPF_PROG_TYPE_SOCKET_FILTER/CGROUP_SKB when kernel.unprivileged_bpf_disabled is 0 (upstream default throughout the 5.8\u20135.11 affected range), which exercises this verifier path without CAP_BPF or CAP_PERFMON. An attacker can reliably craft and load a BPF program with mixed signed-bounds pointer arithmetic on PTR_TO_MAP_VALUE; no race or external environmental condition beyond the attacker\u0027s control is required to reach the buggy check.\nPR:L - Unprivileged users can load BPF_PROG_TYPE_SOCKET_FILTER/CGROUP_SKB when kernel.unprivileged_bpf_disabled is 0 (upstream default throughout the 5.8\u20135.11 affected range), which exercises this verifier path without CAP_BPF or CAP_PERFMON.\nUI:N - Exploitation requires only the attacker loading their own BPF program; no victim action is needed.\nS:U - Impact stays within the kernel\u0027s security authority (local speculative disclosure of kernel memory); this is not a VM/IOMMU/sandbox boundary crossing.\nC:H - The check exists specifically for Spectre v1 masking of map-value pointer arithmetic; bypassing it enables speculative out-of-bounds access that can disclose arbitrary kernel memory via side channels, matching other BPF Spectre CVEs.\nI:N - This is a speculative-execution mitigation gap; architectural verifier bounds still apply and speculative effects do not commit writes, so integrity is not impacted.\nA:H - Same-series BPF Spectre sanitation bugs (e.g. CVE-2020-27171) and existing assessments of this CVE treat failed/incorrect ALU sanitation as potentially crashing the kernel; under the overestimate rule A:H is the higher-severity choice."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:44:59.893Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6"
            },
            {
              "url": "https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51"
            },
            {
              "url": "https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be"
            }
          ],
          "title": "bpf: Use correct permission flag for mixed signed bounds arithmetic",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-46908",
        "datePublished": "2024-02-27T06:53:49.541Z",
        "dateReserved": "2024-02-25T13:45:52.718Z",
        "dateUpdated": "2026-08-05T08:44:59.893Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.