CVE-2021-20239

What it actually does

The flaw permits a local user to craft BPF programs that disclose kernel memory addresses, bypassing KASLR and exposing internal kernel layout information.

Why it matters to the business

Attackers who already have a local account can obtain information that makes subsequent kernel exploits easier, increasing the chance of full system compromise and data exposure on affected Linux systems.

How an attack unfolds

An attacker with a local shell account compiles and loads a malicious BPF program that triggers the address leak in the kernel's BPF verifier or map handling, then reads the disclosed addresses to map kernel memory for further attacks.

How to fix it

Upgrade the Linux kernel to version 5.4.92 or newer on all affected distributions; rebuild and reboot into the patched kernel. Where immediate upgrade is impossible, restrict unprivileged BPF loading via the kernel.unprivileged_bpf_disabled sysctl.

How to confirm the fix worked

Run 'uname -r' and confirm the running kernel is 5.4.92 or later; verify sysctl kernel.unprivileged_bpf_disabled is set if the upgrade is deferred; test with known BPF address-leak PoCs in a lab environment.

Typical attack path

1. Obtain a local user account on the target system
2. Compile and attach a crafted BPF program that exercises the vulnerable code path
3. Read leaked kernel addresses from userspace via BPF map output or error messages
4. Use disclosed addresses to defeat KASLR and prepare follow-on kernel exploits

How to detect it

Review authentication logs for unexpected local logins, auditd records of bpf syscall usage by non-root users, and any post-exploitation activity that follows address disclosure patterns; no widespread public exploits are known.

What your security team should do

• Prioritize kernel upgrades on internet-facing or multi-tenant systems within the next patch cycle
• Enable kernel.unprivileged_bpf_disabled=1 on systems that do not require unprivileged BPF
• Monitor for new public exploits given the long publication window and low EPSS