CVE-2021-46908

bpf: Use correct permission flag for mixed signed bounds arithmetic

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Use correct permission flag for mixed signed bounds arithmetic We forbid adding unknown scalars with mixed signed bounds due to the spectre v1 masking mitigation. Hence this also needs bypass_spec_v1 flag instead of allow_ptr_leaks.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.00%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6	patch
https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51	patch
https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be	patch

Frequently Asked Questions

What is the severity of CVE-2021-46908?: CVE-2021-46908 has been scored as a medium severity vulnerability.
How to fix CVE-2021-46908?: To fix CVE-2021-46908, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2021-46908 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2021-46908 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-46908?: CVE-2021-46908 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.