CVE-2021-20194
Fixed in a distro release EPSS <1%
There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation.
Products: linux_kernel, redhat openshift_container_platform, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | kernel-tools-libs-devel | 4.18.0-348.el8 |
| Chainguard | hyperv-daemons-6.18 | 0 |
| Chainguard | linux-aws-6.12 | 0 |
| Chainguard | linux-aws-6.12 | 6.12.65-r0 |
| Chainguard | linux-aws-6.12-boot-installed | 0 |
| Chainguard | linux-aws-6.12-fips-boot-installed | 0 |
| Chainguard | linux-aws-6.12-headers | 0 |
| Chainguard | linux-aws-6.12-modules | 0 |
| Chainguard | linux-aws-6.18 | 0 |
| Chainguard | linux-aws-6.18 | 6.18.10-r0 |
| Chainguard | linux-aws-6.18-boot-installed | 0 |
| Chainguard | linux-aws-6.18-fips-boot-installed | 0 |
| Chainguard | linux-aws-6.18-headers | 0 |
| Chainguard | linux-aws-6.18-modules | 0 |
| Chainguard | linux-aws-generic-boot-installed | 0 |
| Chainguard | linux-aws-generic-modules | 0 |
| Chainguard | linux-azure-6.12 | 0 |
| Chainguard | linux-azure-6.12 | 6.12.65-r1 |
| Chainguard | linux-azure-6.18 | 0 |
| Chainguard | linux-azure-6.18-boot-installed | 0 |
| Chainguard | linux-azure-6.18-fips-boot-installed | 0 |
| Chainguard | linux-azure-6.18-headers | 0 |
| Chainguard | linux-azure-6.18-modules | 0 |
| Chainguard | linux-azure-generic-modules | 0 |
| Chainguard | linux-desktop-6.18 | no fix |
| Chainguard | linux-desktop-6.18-bootc | no fix |
| Chainguard | linux-desktop-6.18-bootc-boot-installed | no fix |
| Chainguard | linux-desktop-6.18-headers | no fix |
| Chainguard | linux-desktop-6.18-modules | no fix |
| Chainguard | linux-desktop-7.2 | no fix |
| Chainguard | linux-desktop-7.2-bootc | no fix |
| Chainguard | linux-desktop-7.2-bootc-boot-installed | no fix |
| Chainguard | linux-desktop-7.2-headers | no fix |
| Chainguard | linux-desktop-7.2-modules | no fix |
| Chainguard | linux-firecracker-6.18 | no fix |
| Chainguard | linux-gcp-6.12 | 0 |
| Chainguard | linux-gcp-6.12 | 6.12.65-r0 |
| Chainguard | linux-gcp-6.18 | 0 |
| Chainguard | linux-gcp-6.18 | 6.18.10-r0 |
| Chainguard | linux-gcp-6.18-boot-installed | 0 |
| Chainguard | linux-gcp-6.18-fips-boot-installed | 0 |
| Chainguard | linux-gcp-6.18-headers | 0 |
| Chainguard | linux-gcp-6.18-modules | 0 |
| Chainguard | linux-gcp-generic-modules | 0 |
| Chainguard | linux-microvm-6.18 | no fix |
| Chainguard | linux-microvm-6.18-image-compressed | no fix |
| Chainguard | linux-microvm-6.18-image-uncompressed | no fix |
| Chainguard | linux-microvm-6.18-loadpin-test | no fix |
| Chainguard | linux-microvm-6.18-modules | no fix |
| Chainguard | linux-microvm-7.3 | no fix |
| Chainguard | linux-microvm-7.3-image-compressed | no fix |
| Chainguard | linux-microvm-7.3-image-uncompressed | no fix |
| Chainguard | linux-microvm-7.3-modules | no fix |
| Chainguard | linux-qemu-6.12 | 6.12.71-r0 |
| Chainguard | linux-qemu-6.18 | 6.18.10-r0 |
| Chainguard | linux-qemu-generic | 6.18.5-r0 |
| Chainguard | linux-qemu-generic | 0 |
| Chainguard | linux-qemu-melange | 6.18.16-r0 |
| Chainguard | linux-qemu-rc | 6.18_rc7-r2 |
| Chainguard | linux-qemu-rc | 6.18_rc6-r0 |
| Chainguard | linux-qemu-rc | 6.19_rc1-r1 |
| Chainguard | linux-qemu-rc | 6.19_rc2-r0 |
| Chainguard | linux-qemu-rc | 0 |
| Chainguard | linux-qemu-rc | 6.19_rc3-r0 |
| Chainguard | linux-qemu-rc | 6.18_rc7-r3 |
| Chainguard | linux-qemu-rc | 6.18_rc5-r1 |
| Chainguard | linux-qemu-rc | 6.18_rc5-r0 |
| Chainguard | linux-qemu-rc | 6.19_rc1-r0 |
| Chainguard | linux-qemu-rc | 6.19_rc4-r0 |
| Chainguard | linux-qemu-rc | 6.19_rc5-r0 |
| Chainguard | linux-qemu-rc | 6.19_rc1-r2 |
| Chainguard | linux-qemu-rc-boot-installed | 0 |
| Chainguard | linux-qemu-rc-fips-boot-installed | 0 |
| Chainguard | linux-qemu-rc-headers | 0 |
| Chainguard | linux-qemu-rc-modules | 0 |
| Chainguard | linux-raspberry-pi | no fix |
| Chainguard | linux-raspberry-pi-4 | no fix |
| Chainguard | linux-raspberry-pi-4-boot-configuration | no fix |
| Chainguard | linux-raspberry-pi-4-bootc | no fix |
| Chainguard | linux-raspberry-pi-boot-configuration | no fix |
| Chainguard | linux-raspberry-pi-bootc | no fix |
| Chainguard | linux-server-7.2 | no fix |
| Chainguard | linux-server-7.2-bootc | no fix |
| Chainguard | linux-server-7.2-bootc-boot-installed | no fix |
| Chainguard | linux-server-7.2-headers | no fix |
| Chainguard | linux-server-7.2-modules | no fix |
| Chainguard | linux-vmware-6.12 | 6.12.71-r0 |
| Chainguard | linux-vmware-6.18 | 6.18.10-r0 |
| Debian 12 | linux | 5.10.19-1 |
| Debian 13 | linux | 5.10.19-1 |
| Debian 14 | linux | 5.10.19-1 |
| Red Hat Enterprise Linux 8 | bpftool | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | bpftool-debuginfo | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-abi-stablelists | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-core | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debug | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debug-core | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debug-debuginfo | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debug-devel | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debug-modules | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debug-modules-extra | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debuginfo | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debuginfo-common-aarch64 | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debuginfo-common-ppc64le | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debuginfo-common-s390x | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-debuginfo-common-x86_64 | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-devel | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-doc | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-modules | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-modules-extra | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-core | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debug | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debug-core | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debug-debuginfo | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debug-devel | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debug-kvm | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debug-modules | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debug-modules-extra | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debuginfo | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-debuginfo-common-x86_64 | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-devel | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-kvm | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-modules | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-rt-modules-extra | 0:4.18.0-348.rt7.130.el8 |
| Red Hat Enterprise Linux 8 | kernel-tools | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-tools-debuginfo | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-tools-libs | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-tools-libs-devel | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-zfcpdump | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-zfcpdump-core | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-zfcpdump-debuginfo | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-zfcpdump-devel | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-zfcpdump-modules | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | kernel-zfcpdump-modules-extra | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | perf | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | perf-debuginfo | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | python3-perf | 0:4.18.0-348.el8 |
| Red Hat Enterprise Linux 8 | python3-perf-debuginfo | 0:4.18.0-348.el8 |
| Ubuntu 16.04 LTS | linux-hwe-edge | no fix |
| Ubuntu 18.04 LTS | linux-aws-5.0 | no fix |
| Ubuntu 18.04 LTS | linux-aws-5.3 | no fix |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1043.45~18.04.1 |
| Ubuntu 18.04 LTS | linux-azure | no fix |
| Ubuntu 18.04 LTS | linux-azure-5.3 | no fix |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1044.46~18.04.1 |
| Ubuntu 18.04 LTS | linux-azure-edge | no fix |
| Ubuntu 18.04 LTS | linux-gcp | no fix |
| Ubuntu 18.04 LTS | linux-gcp-5.3 | no fix |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1041.44~18.04.1 |
| Ubuntu 18.04 LTS | linux-gcp-edge | no fix |
| Ubuntu 18.04 LTS | linux-gke-4.15 | no fix |
| Ubuntu 18.04 LTS | linux-gke-5.4 | 5.4.0-1040.42~18.04.1 |
| Ubuntu 18.04 LTS | linux-gkeop-5.4 | 5.4.0-1013.14~18.04.1 |
| Ubuntu 18.04 LTS | linux-hwe | no fix |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-71.79~18.04.1 |
| Ubuntu 18.04 LTS | linux-hwe-edge | no fix |
| Ubuntu 18.04 LTS | linux-oem | no fix |
| Ubuntu 18.04 LTS | linux-oracle-5.0 | no fix |
| Ubuntu 18.04 LTS | linux-oracle-5.3 | no fix |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1042.45~18.04.1 |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1033.36~18.04.1 |
| Ubuntu 20.04 LTS | linux | 5.4.0-71.79 |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1043.45 |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1044.46 |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1041.44 |
| Ubuntu 20.04 LTS | linux-gke | 5.4.0-1041.43 |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1013.14 |
| Ubuntu 20.04 LTS | linux-hwe-5.8 | 5.8.0-45.51~20.04.1 |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1037.38 |
| Ubuntu 20.04 LTS | linux-oem-5.10 | 5.10.0-1017.18 |
| Ubuntu 20.04 LTS | linux-oem-5.6 | 5.6.0-1053.57 |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1042.45 |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1033.36 |
| Ubuntu 20.04 LTS | linux-raspi2 | no fix |
| Ubuntu 20.04 LTS | linux-riscv | no fix |
| Ubuntu 20.04 LTS | linux-riscv-5.8 | 5.8.0-18.20~20.04.1 |
| Ubuntu 22.04 LTS | linux-intel-iot-realtime | no fix |
| Ubuntu 22.04 LTS | linux-realtime | no fix |
| Ubuntu 24.04 LTS | linux-raspi-realtime | no fix |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1069.73+fips2 |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1073.76+fips1 |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1067.71~20.04.1 |
| Ubuntu Pro FIPS 20.04 LTS | linux-aws-fips | no fix |
| Ubuntu Pro FIPS 20.04 LTS | linux-azure-fips | no fix |
| Ubuntu Pro FIPS 20.04 LTS | linux-gcp-fips | no fix |