An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations.
[
{
"id": "CVE-2021-29155-17044bca",
"signature_version": "v1",
"digest": {
"function_hash": "164862801161063965694009978540384139876",
"length": 5487.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6f55b2f2a1178856c19bbce2f71449926e731914",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_ptr_min_max_vals"
}
},
{
"id": "CVE-2021-29155-297aef86",
"signature_version": "v1",
"digest": {
"function_hash": "129522929628026699063173342839688519691",
"length": 882.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b658bbb844e28f1862867f37e8ca11a8e2aa94a3",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "retrieve_ptr_limit"
}
},
{
"id": "CVE-2021-29155-31a8103f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"18165135779466820786240274213792935398",
"95259640639970879322579420980295413419",
"239595718824113794663481850682138365523",
"129067249238655189403987183909363535355",
"7033306917882309472277196867027508268",
"229010441627964760320165366945862358838",
"146782000889997755148431255122921608307",
"151100974297558672289298084388186347251",
"184197069414713142732147949061168315429",
"52825033788360440135229320070253319667",
"223785969030333388027105467265623409792",
"84225908660257451551892265813981780750",
"56490882799611671169107109085776128232",
"148588434042610851386580508980923399027",
"25001129255759929241033037036513035837",
"62146069999977052098498354794415705089"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6f55b2f2a1178856c19bbce2f71449926e731914",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/verifier.c"
}
},
{
"id": "CVE-2021-29155-40c7b7bf",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218714449604499915071694496152356323250",
"45704365308297903021096708014382581274",
"337559564869367164935353401567183924801",
"286272596960287988914324541723015790463",
"31651886707842055480376838760699901522",
"276972620993420840103961910619076327396",
"10663515993386016079925984320512055971",
"110226294205823067773151592943417720580",
"10159363312468416494411373139083858061",
"229007737145066186988165548592200566373",
"224880947185908388246783261138729747607",
"10322464107095078227980000674642629487",
"37253300164757187743546013874133533409",
"47049342480494653258562682088782761012",
"96863880894955747406993311961143116688",
"138190035494557935594915829779364314815",
"307581971852586362949562012419242584368",
"182334636420870205911316796809877339874",
"65766865064511021184778102562587617964",
"200391326299233568889925386308167066475",
"248380800917530653289931174969630350531",
"134870460839031606626165630449261130974",
"246951637073595837889355820121401332160",
"211991352364883930535285279291394399775",
"308431547342429937292279092715558264872",
"16826815232114989779007611329666355583",
"9208282887981355045469600353505587300",
"113929299524522302058180961132103825417",
"80412179878676341024713492143350018712",
"304052767062712656945406038862972436159",
"1167191890427871827893471209599840187",
"277903420204662893063976861276523116429",
"218403699623223321300023898703005062395",
"198268347358126782002822913984997640338",
"160898182728783937668524384368658720067",
"283466069986278212952458825142613371547",
"113131266652001335102075890489587246797",
"333245929769086122320040392041756776377",
"308628460436977131723204329427590591947",
"153674347189071481141495294681311852841",
"179868309379708541183741148071118809048",
"30245767556070096008348750648808255909",
"76012561014517903681786343963048840990",
"128120564325291665045069176503699653329",
"122580673523133397609928565749697646576",
"249084933148502903653399747795131059787",
"12765023030365364359184909482460447171",
"104878718937763474962565409791071604649",
"148688740199615426218807273791977049627",
"237058203963425871482760356256811059175",
"279121862496495216908928487347795756801",
"296892783827672391565124721557533449945",
"268916771192513158724696988427715547471",
"281180860769557978304330871874727058476",
"55998260742504708179481514331255418923",
"167148449908504351643592200523687389853",
"11507441996209466956660011787504380593",
"114984108854163346958024591981773036019",
"100696395561043789672158484610323975890"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a6aaece00a57fa6f22575364b3903dfbccf5345d",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/verifier.c"
}
},
{
"id": "CVE-2021-29155-5459d4b3",
"signature_version": "v1",
"digest": {
"function_hash": "60870908949411455329061192303702779501",
"length": 5483.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@24c109bb1537c12c02aeed2d51a347b4d6a9b76e",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_ptr_min_max_vals"
}
},
{
"id": "CVE-2021-29155-610951d9",
"signature_version": "v1",
"digest": {
"function_hash": "17207822245785881964029576319337059621",
"length": 5048.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@073815b756c51ba9d8384d924c5d1c03ca3d1ae4",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_ptr_min_max_vals"
}
},
{
"id": "CVE-2021-29155-63fa301d",
"signature_version": "v1",
"digest": {
"function_hash": "118425757277851489570446696058348173292",
"length": 5166.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a6aaece00a57fa6f22575364b3903dfbccf5345d",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_ptr_min_max_vals"
}
},
{
"id": "CVE-2021-29155-68ee160f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"246695606581409387158863810852610618632",
"89246996787328126017189709845583227179",
"264052653408367067844449628668108182984",
"3428031845225140226106607569969277222"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@9601148392520e2e134936e76788fc2a6371e7be",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/verifier.c"
}
},
{
"id": "CVE-2021-29155-95f558ab",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"282058195687562348807590427065618562896",
"229491056612342112157534733552571010298",
"24098686306953093500402656621660559655",
"197443242739242875515893212178046111856",
"136783983040573813371244765474366764371",
"123563401680879400511556730884885576558",
"205921153490719296369803338620003546654",
"225341317714956895510542625910210530662",
"283415009912651935474711580666517776005",
"192904543428502092962290560719042398038",
"221074064320735200714409252319742698665",
"140254163173515040014738161207272852339",
"323250515656912679688432143519061003349",
"75703500411777127859942646105302643121",
"312221723989749002659137762668406974075",
"323289905906955971735130469896815318353",
"156179445604542804812792190578541516583",
"267868390585593816517915983992887850017",
"160495847613381060821701226266193473158"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@073815b756c51ba9d8384d924c5d1c03ca3d1ae4",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/verifier.c"
}
},
{
"id": "CVE-2021-29155-96bb81d3",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"103381520136910515326319962908350619792",
"174671424062403317975331388893570055356",
"240138156490599121090017960305332017170",
"61538807258198900382036402616293581741",
"164789574237162029473849685868090933925",
"152598167109669477434781474109259295991",
"19833889899567726430103307955643145870",
"37915013268495139981619116539606986265",
"339628609768221077499045785554570858040",
"127171693933109560675765896771415348912",
"2827028564972159045492176152675064713",
"281665525742919943358003718327045116952",
"154205237447540980422613041993411640179",
"277248056179856428323883280196159250863",
"51619959257697419040360827431265675288",
"320873981949883250169675360434733681353",
"54309377834036054453075276415501086305",
"291147809898473125455233745190031336292",
"228907941431799189482458587946938987439",
"215058551496031886863212314320174235595",
"180273889910095370472478233335563311452",
"99247017949532833990554890180049661866",
"246017629092455155781646704554876433963",
"248558748876448854764262267301539635020",
"256967401235602108300502029958783705003",
"245874587135355277073503778848147423092",
"110578728074716448979661304221439680833"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@24c109bb1537c12c02aeed2d51a347b4d6a9b76e",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/verifier.c"
}
},
{
"id": "CVE-2021-29155-ab49baa5",
"signature_version": "v1",
"digest": {
"function_hash": "60125803834267096025895124146004869023",
"length": 3027.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a6aaece00a57fa6f22575364b3903dfbccf5345d",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_scalar_min_max_vals"
}
},
{
"id": "CVE-2021-29155-ab5544db",
"signature_version": "v1",
"digest": {
"function_hash": "142326869828688370603557871141678287265",
"length": 881.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a6aaece00a57fa6f22575364b3903dfbccf5345d",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "retrieve_ptr_limit"
}
},
{
"id": "CVE-2021-29155-bec80b3c",
"signature_version": "v1",
"digest": {
"function_hash": "160452684997634312016654078286960967430",
"length": 835.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6f55b2f2a1178856c19bbce2f71449926e731914",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "sanitize_ptr_alu"
}
},
{
"id": "CVE-2021-29155-da8e8f13",
"signature_version": "v1",
"digest": {
"function_hash": "254203844896245676810631648929513771012",
"length": 721.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@24c109bb1537c12c02aeed2d51a347b4d6a9b76e",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "retrieve_ptr_limit"
}
},
{
"id": "CVE-2021-29155-f2a4b994",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"77442960050802318017876812559493279828",
"17024102001121765798611469774481744867",
"317420923171753003864553608592077412773",
"28790782144294165209606382352639598432",
"322566115669594912920201594012322327461",
"315394372177304065452348004302456537939",
"9710260800311349913489575272970318264",
"79744331044420135662543514852116749169",
"173958753945913611780335049680329315604",
"91353858336321839177407612782874704137",
"281121866354856682736356125141732049179",
"78120081378425938711158484242589393340",
"12681233806988702066940340265223172683",
"190325117125731474052243082973318793669",
"99065929489019578606292325744868239580",
"76080056008053321959766691794795573283",
"176748401582100084918356824603030810082",
"176166272087760497658427359553450459014",
"53489083422022700743345050693036682854",
"92698929727185929191414450349533153952",
"20934781664022044134356079199617571148",
"240827568142428504439373417182596109529",
"29570101623088431545270829205553503809",
"103414314099636969154622259445362891080",
"334930419479257539789805211069697029932",
"230854622574928264560172461107740349273",
"124093624003048441552304101444919791307",
"129820969237192913484681455087087279687"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b658bbb844e28f1862867f37e8ca11a8e2aa94a3",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/verifier.c"
}
},
{
"id": "CVE-2021-29155-f339e61b",
"signature_version": "v1",
"digest": {
"function_hash": "36952929240060046129653812201293762974",
"length": 877.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@24c109bb1537c12c02aeed2d51a347b4d6a9b76e",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "sanitize_ptr_alu"
}
},
{
"id": "CVE-2021-29155-f3ab1a59",
"signature_version": "v1",
"digest": {
"function_hash": "125843481326521891639350157180231397173",
"length": 5479.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@9601148392520e2e134936e76788fc2a6371e7be",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_ptr_min_max_vals"
}
},
{
"id": "CVE-2021-29155-f3e9be70",
"signature_version": "v1",
"digest": {
"function_hash": "102443136265330604787204548666536511157",
"length": 230.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a6aaece00a57fa6f22575364b3903dfbccf5345d",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "update_alu_sanitation_state"
}
},
{
"id": "CVE-2021-29155-ff760747",
"signature_version": "v1",
"digest": {
"function_hash": "281371583213950479723288722972705128640",
"length": 879.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a6aaece00a57fa6f22575364b3903dfbccf5345d",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "sanitize_ptr_alu"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29155.json"