CVE-2021-20239: 
Linux Kernel vulnerability analysis and mitigation

A flaw was discovered in the Linux kernel versions before 5.4.92 in the BPF (Berkeley Packet Filter) protocol. The vulnerability, identified as CVE-2021-20239, was discovered by Ryota Shiga and allows an attacker with a local account to leak information about kernel internal addresses (CVE Mitre, Ubuntu Security).

The vulnerability exists in the sockopt BPF hooks implementation where a user space program can probe for valid kernel addresses. The issue specifically relates to the BPF protocol's handling of setsockopt system calls, where an untrusted pointer dereference can lead to information disclosure. The vulnerability has been assigned a CVSS 3 Severity Score of 3.3 (Low) (Ubuntu Security, Red Hat Bugzilla).

The highest threat from this vulnerability is to confidentiality. The flaw could allow an attacker to determine the layout of information in kernel memory, which could potentially be used to facilitate future attacks. This information leak may aid an attacker in privilege escalation attempts, although it does not directly enable privilege escalation (Red Hat Bugzilla).

Loading a filter is a privileged operation requiring CAP_SYS_ADMIN or root privileges. However, once any filter is used, the attack can be executed by an unprivileged user. The vulnerability has been documented as ZDI-21-100, and proof-of-concept code has been publicly shared (Red Hat Bugzilla).

The vulnerability has been fixed in Linux kernel version 5.4.92 and later. Various Linux distributions have released patches, including Ubuntu 20.04 LTS (fixed in 5.4.0-67.75) and Ubuntu 18.04 LTS (fixed in 5.4.0-67.75~18.04.1). No suitable mitigation was identified for systems that cannot be immediately patched (Ubuntu Security, Red Hat Bugzilla).