cve-2021-3490-ebpf-analysis

Research implementation demonstrating interaction with Linux eBPF subsystem related to CVE-2021-3490. Includes BPF map creation, syscall wrappers, namespace setup, and verifier analysis. For educational and security research purposes only.

CVE-2021-3490 – eBPF Verifier Bounds Tracking Analysis Overview

This repository contains C implementation exploring the Linux kernel eBPF subsystem in relation to CVE-2021-3490, a vulnerability involving incorrect 32-bit bounds tracking in the eBPF verifier.

The goal of this project is to understand how the bpf() system call works internally, how BPF maps are created and managed from user space, and how the verifier handles register constraints. This is a research and learning project focused on kernel internals and security analysis.

This code is not intended for production use.

Background

eBPF allows user-space programs to load verified bytecode into the Linux kernel. Before execution, the kernel verifier checks that the program:

Does not perform unsafe memory access

Stays within register bounds

Does not violate kernel safety rules

In vulnerable kernel versions, the verifier incorrectly tracked 32-bit bounds during certain ALU operations. This flaw could allow crafted programs to bypass validation logic.

For official details:

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-3490

Ubuntu Security Notice: https://ubuntu.com/security/CVE-2021-3490

Red Hat Advisory: https://access.redhat.com/security/cve/CVE-2021-3490

What This Project Demonstrates

This implementation focuses on:

Direct use of the bpf() syscall

Manual definition of union bpf_attr

BPF map creation (BPF_MAP_TYPE_ARRAY)

Updating and querying map elements

Retrieving BPF object metadata

Namespace setup for controlled execution

It is designed to help understand how user-space interacts with kernel BPF infrastructure.

This repository does not include automated exploit payload logic.

Tested Environment

Ubuntu 20.10 (Groovy)

Linux kernel 5.8.0-48-generic

You can check your kernel version with:

uname -r

Behavior may differ on patched or newer kernels.

Build

Compile using GCC:

gcc -o exploit exploit.c -lpthread

No external libraries are required beyond standard Linux headers.

Usage

Run the program:

./exploit

The program will:

Configure user and network namespaces

Create a BPF map

Insert an element

Query map metadata

Display execution results

Security Note

This project is for:

Educational purposes

Kernel security research

Understanding eBPF internals

Controlled lab environments

Do not run this code on systems without proper authorization.

Learning Goals

Through this project, you can understand:

How the Linux kernel exposes the BPF interface

How BPF maps are structured

How verifier logic interacts with user-space inputs

How low-level syscalls are constructed manually