=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN416
_____________________________________________________________________

DATE                : 20/08/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): BIG-IP software, BIG-IQ Centralized Management
                         software, F5OS, Traffix SDC.

=====================================================================
https://support.f5.com/csp/article/K43346111
_____________________________________________________________________


K43346111: Linux kernel eBPF vulnerability CVE-2021-3490

Security Advisory

Original Publication Date: Aug 18, 2021


Security Advisory Description

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the
Linux kernel did not properly update 32-bit bounds, which could be
turned into out of bounds reads and writes in the Linux kernel and
therefore, arbitrary code execution. This issue was fixed via commit
049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise
operations") (v5.13-rc4) and backported to the stable kernels in
v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by
commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking")
(5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a
verifier failure with xor") ( 5.10-rc1). (CVE-2021-3490)


Impact

A local attacker can exploit the vulnerability to cause an out-of-bounds
memory read or write to obtain restricted information, modify files, or
cause a denial of service (DoS).


Security Advisory Status

F5 Product Development has assigned SDC-1320 (Traffix SDC) to this
vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine
if your release is known to be vulnerable, the components or features
that are affected by the vulnerability, and for information about
releases, point releases, or hotfixes that address the vulnerability,
refer to the following table. For more information about security
advisory versioning, refer to K51812227: Understanding security advisory
versioning.

Note: After a fix is introduced for a given minor branch, that fix
applies to all subsequent maintenance and point releases for that
branch, and no additional fixes for that branch will be listed in the
table. For example, when a fix is introduced in 14.1.2.3, the fix also
applies to 14.1.2.4, and all later 14.1.x releases (14.1.3.x.,
14.1.4.x). For more information, refer to K51812227: Understanding
security advisory versioning. Additionally, software versions preceding
those listed in the following table have reached the End of Technical
Support (EoTS) phase of their lifecycle and are no longer evaluated for
security issues. For more information, refer to the Security hotfixes
section of K4602: Overview of the F5 security vulnerability response
policy.

Product 	
Branch 	Versions known to be vulnerable1 	Fixes
introduced in 	Severity 	CVSSv3 score2 	Vulnerable component or
feature

BIG-IP (all modules) 	
16.x    None    Not applicable  Not vulnerable  None    None
15.x    None    Not applicable
14.x    None    Not applicable
13.x    None    Not applicable
12.x    None    Not applicable
11.x    None    Not applicable

BIG-IQ Centralized Management 	
8.x     None    Not applicable  Not vulnerable 	None    None
7.x     None    Not applicable
6.x     None    Not applicable

F5OS 	
1.x     None 	Not applicable 	Not vulnerable 	None    None

Traffix SDC 	5.2.x 	5.2.0 	None            High    7.8    Linux
                                                           kernel (eBPF)

                 5.1.x 	None 	Not applicable

1F5 evaluates only software versions that have not yet reached the End
of Technical Support (EoTS) phase of their lifecycle.

2The CVSSv3 score link takes you to a resource outside of AskF5, and it
is possible that the document may be removed without our knowledge.


Recommended Actions

If you are running a version listed in the Versions known to be
vulnerable column, you can eliminate this vulnerability by installing a
version listed in the Fixes introduced in column. If the Fixes
introduced in column does not list a version for your branch, then no
update candidate currently exists for that branch and F5 recommends
upgrading to a version with the fix (refer to the table).

If the Fixes introduced in column lists a version prior to the one you
are running, in the same branch, then your version should have the fix.


Mitigation

There is no specific mitigation, but note that unprivileged users cannot
use eBPF.


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================