CVEs-PoC/2021/CVE-2021-3489.md

### [CVE-2021-3489](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3489)
![](https://img.shields.io/static/v1?label=Product&message=Linux%20kernel&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=trunk%3C%20v5.13-rc4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119%20Improper%20Restriction%20of%20Operations%20within%20the%20Bounds%20of%20a%20Memory%20Buffer&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%20Out-of-bounds%20Write&color=brighgreen)

### Description

The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/tanjiti/sec_profile
- https://github.com/yifengyou/ebpf
- https://github.com/yifengyou/learn-ebpf