3 ms·
I’m no expert, but from the looks of thing it seems like a local privilege escalation vulnerability/exploit, tied to the Linux kernel’s eBPF subsystem. So depe
by josteink 5y ago
I’m no expert, but from the looks of thing it seems like a local privilege escalation vulnerability/exploit, tied to the Linux kernel’s eBPF subsystem.
So depending on your use case it may not be a “stop the line” vulnerability, but I would still like to know if this is patched yet or not in the latest Ubuntu repos.
- deadbunny 5y agoWould be helpful if they providing/had a CVE.
- wg-throw-away 5y agoThe CVE for this is probably CVE-2021-3489 based on hints of "pwn2own" and "April 2021" and "Flatt Security" -> https://www.zerodayinitiative.com/advisories/ZDI-21-590/ https://www.zerodayinitiative.com/advisories/ZDI-21-590/
- Ga_ryo_ 5y agoYes, this report is about CVE-2021-3489 which is patched a few months ago. I(author) forgot to add such info.
- wg-throw-away 5y agoI don't think that ZDI releases any details until the vulnerability is patched. If this is indeed CVE-2021-3489 then Canonical says it's patched in https://ubuntu.com/security/notices/USN-4949-1 https://ubuntu.com/security/notices/USN-4949-1 and https://ubuntu.com/security/notices/USN-4950-1 https://ubuntu.com/security/notices/USN-4950-1