PT-2021-7323 · Linux+9 · Linux Kernel Overlayfs Subsystem+9

Alex · Published 2021-09-24 · Updated 2023-08-14 · CVE-2021-20321

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel OverlayFS subsystem (affected versions not specified)

Description A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific ways with OverlayFS. This issue could allow a local user to crash the system. The vulnerability is related to incorrect synchronization when accessing shared resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALSA-2021:5227

ALT-PU-2021-3330

ALT-PU-2021-3358

ALT-PU-2021-3563

ALT-PU-2021-3573

ALT-PU-2021-3660

ALT-PU-2022-1240

ALT-PU-2022-1419

ALT-PU-2022-1421

ALT-PU-2023-1814

ALT-PU-2023-4894

BDU:2022-05684

CESA-2021_5227

CESA-2021_5241

CVE-2021-20321

DLA-2843-1

DLA-2941-1

DSA-5096-1

MGASA-2021-0489

MGASA-2021-0490

OESA-2021-1475

OPENSUSE-SU-2022_1676-1

OPENSUSE-SU-2022_1687-1

OPENSUSE-SU-2022_2111-1

RHSA-2021:5227

RHSA-2021:5241

RHSA-2021_5227

RHSA-2021_5241

RLSA-2021:5227

RLSA-2021:5241

SUSE-SU-2022:1651-1

SUSE-SU-2022:1668-1

SUSE-SU-2022:1669-1

SUSE-SU-2022:1676-1

SUSE-SU-2022:1686-1

SUSE-SU-2022:1687-1

SUSE-SU-2022:2077-1

SUSE-SU-2022:2082-1

SUSE-SU-2022:2083-1

SUSE-SU-2022:2103-1

SUSE-SU-2022:2104-1

SUSE-SU-2022:2111-1

SUSE-SU-2022_1651-1

SUSE-SU-2022_1669-1

SUSE-SU-2022_1676-1

SUSE-SU-2022_1686-1

SUSE-SU-2022_1687-1

USN-5208-1

USN-5209-1

USN-5210-1

USN-5210-2

USN-5218-1

USN-6221-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Linux Kernel Overlayfs Subsystem

Red Hat

Rocky Linux

Suse

Ubuntu

References · 253

• https://nvd.nist.gov/vuln/detail/CVE-2021-4037 · Security Note
• https://osv.dev/vulnerability/DSA-5096-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6221-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43389 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9088.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0489 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1686-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2077-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20321 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20317 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2111-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5096 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20321 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1687-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1475 · Vendor Advisory