CVE-2021-4159

What it actually does

The eBPF verifier exposes internal kernel memory addresses to userspace when handling data structures, allowing a local attacker with eBPF insertion permissions to leak kernel pointers and defeat KASLR and similar mitigations.

Why it matters to the business

Organizations running vulnerable Linux kernels face increased risk of successful kernel exploits because memory layout randomization protections can be bypassed, potentially leading to full system compromise; the issue affects many distributions and cloud workloads but has low public exploit activity.

How an attack unfolds

An attacker with local access and capability to load eBPF programs crafts a malicious eBPF program that triggers the verifier flaw, receives leaked kernel memory addresses, and uses those addresses to bypass exploit mitigations and escalate privileges or execute arbitrary code in the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 294f2fc6da27620a506e6c050241655459ccd6bd or later; apply vendor backports for supported distributions and rebuild any custom kernels with the fix.

How to confirm the fix worked

Verify the running kernel contains commit 294f2fc6da27620a506e6c050241655459ccd6bd or equivalent backport; inspect /proc/version or kernel build logs and confirm the eBPF verifier no longer returns internal addresses in test programs.

Typical attack path

1. Obtain local access on a Linux system with eBPF permissions
2. Load a crafted eBPF program that triggers the verifier bug
3. Receive leaked internal kernel memory addresses from userspace
4. Use leaked addresses to defeat KASLR and other mitigations
5. Chain with another kernel vulnerability for privilege escalation or persistence

How to detect it

Review audit logs for unexpected eBPF program loads, check for processes using bpf() syscalls from non-standard users, and look for post-exploitation artifacts such as attempts to read kernel symbols or map kernel memory after eBPF activity.

What your security team should do

• Prioritize kernel updates on systems that allow untrusted local users to load eBPF programs
• Restrict eBPF loading to trusted processes via capabilities or LSM policies until patches are applied
• Monitor for new kernel releases and test patches in staging environments
• Review eBPF usage across the fleet and disable where unnecessary