CVE-2021-38300
📋 TL;DR
This vulnerability in the Linux kernel's MIPS BPF JIT compiler allows unprivileged users to execute arbitrary code with kernel privileges. It affects Linux systems running on MIPS architecture with kernel versions before 5.4.10. Attackers can exploit this to gain full system control.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with kernel-level code execution leading to persistent root access, data theft, and system destruction.
Likely Case
Local privilege escalation allowing attackers to gain root privileges on affected systems.
If Mitigated
Limited impact if proper access controls restrict unprivileged users from executing BPF programs.
🎯 Exploit Status
Exploitation requires local access and ability to load unprivileged BPF programs. Proof-of-concept code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.4.10 and later
Vendor Advisory: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.10
Restart Required: Yes
Instructions:
1. Update kernel to version 5.4.10 or later
2. Reboot system
3. Verify kernel version with 'uname -r'
4. For distributions: use package manager (apt/yum) to update kernel package
🔧 Temporary Workarounds
Disable BPF JIT for unprivileged users
linuxPrevents unprivileged users from using BPF JIT compiler
echo 0 > /proc/sys/net/core/bpf_jit_enable
sysctl -w net.core.bpf_jit_enable=0
Restrict BPF system calls
linuxUse seccomp or other mechanisms to block bpf() syscall
Add BPF to seccomp filter rules
🧯 If You Can't Patch
- Implement strict access controls to prevent unprivileged users from executing BPF programs
- Use security modules like SELinux or AppArmor to restrict BPF capabilities
🔍 How to Verify
Check if Vulnerable:
Check kernel version and architecture: 'uname -r' and 'uname -m'. If version < 5.4.10 and architecture is MIPS, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.4.10 or later with 'uname -r' and check that architecture is MIPS.📡 Detection & Monitoring
Log Indicators:
- Failed BPF program loads
- Kernel oops or crashes
- Unexpected privilege escalation attempts
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
source="kernel" AND ("BPF" OR "bpf_jit") AND ("error" OR "failed" OR "oops")🔗 References
- http://www.openwall.com/lists/oss-security/2021/09/15/5
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://security.netapp.com/advisory/ntap-20211008-0003/
- https://www.debian.org/security/2022/dsa-5096
- http://www.openwall.com/lists/oss-security/2021/09/15/5
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://security.netapp.com/advisory/ntap-20211008-0003/
- https://www.debian.org/security/2022/dsa-5096
