PT-2021-1523 · Linux+11 · Linux Kernel+11
Published
2021-11-22
·
Updated
2023-10-06
·
CVE-2021-4083
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.16-rc4
Description
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers. This issue occurs when users call
close() and fget() simultaneously, potentially triggering a race condition. The flaw allows a local user to crash the system or escalate their privileges on the system.Recommendations
For Linux kernel versions prior to 5.16-rc4, update to version 5.16-rc4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable
fget() function until a patch is available. Additionally, be cautious when using the close() function in conjunction with fget() to minimize the risk of exploitation.Fix
DoS
Race Condition
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node