PT-2021-4066 · Linux+1 · Linux Kernel+1

Norbert Slusarek · Published 2021-05-11 · Updated 2025-09-29 · CVE-2021-32606

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.11 through 5.12.2

Description The issue is related to the isotp setsockopt function in the net/can/isotp.c component of the Linux kernel, which involves the use of memory after it has been freed. This can allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability can also be exploited for privilege escalation to root by leveraging the use-after-free, affecting the Linux kernel versions 5.11 through 5.12.2. Earlier versions that lack CAN ISOTP SF BROADCAST support are not affected.

Recommendations For Linux kernel versions 5.11 through 5.12.2, update to a version that includes the fix for the isotp setsockopt use-after-free issue. As a temporary workaround, consider restricting access to the isotp setsockopt function in the net/can/isotp.c component until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025_16880

ALT-PU-2021-1990

ALT-PU-2021-2026

ALT-PU-2021-2315

ALT-PU-2021-2326

ALT-PU-2021-2330

ALT-PU-2021-3481

BDU:2021-04607

CVE-2021-32606

OPENSUSE-SU-2024:10728-1

OPENSUSE-SU-2024:13704-1

Affected Products

Alt Linux

Linux Kernel

References · 224

• 🔥 https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-32606/cve-2021-32606.md · Exploit
• https://cve.org/CVERecord?id=CVE-2021-32606 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-32606 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GI7Z7UBWBGD3ABNIL2DC7RQDCGA4UVQW · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32606 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10728-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32606 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HD3NJBG25AADVGPRC63RX2JOQBMPSWK4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73D53S4IZFPFQMRABMXXLW4AJK3EULDX · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/05/28/1 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:13704-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32606 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04607 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32606 · Vendor Advisory
• https://suse.com/security/cve/CVE-2022-29901 · Note