Published: 22/04/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

CVSS v3 Base Score: 7 | Impact Score: 5.9 | Exploitability Score: 1

VMScore: 615

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) prior to 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
fedoraproject fedora 32
fedoraproject fedora 33
fedoraproject fedora 34
debian debian linux 9.0
netapp cloud backup -
netapp solidfire & hci management node -
broadcom brocade fabric operating system -
netapp h410c firmware -
netapp h300s firmware -
netapp h500s firmware -
netapp h700s firmware -
netapp h300e firmware -
netapp h500e firmware -
netapp h700e firmware -
netapp h410s firmware -
netapp solidfire baseboard management controller firmware -

kernel: refcount leak in llcp_sock_bind() (CVE-2020-25670) kernel: refcount leak in llcp_sock_connect() (CVE-2020-25671) kernel: memory leak in llcp_sock_connect() (CVE-2020-25672) An issue was discovered in the Linux kernel related to mm/gupc and mm/huge_memoryc The get_user_pages (aka gup) implementation, when used for a copy-on-write page, do ...

An issue was discovered in the Linux kernel related to mm/gupc and mm/huge_memoryc The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access (CVE-2020-29374) A use-after-free flaw was found in the Linux kernel's SCT ...

A use-after-free flaw was found in the Linux kernel's NFC LLCP protocol implementation in the way the user performs manipulation with an unknown input for the llcp_sock_bind() function This flaw allows a local user to crash or escalate their privileges on the system (CVE-2020-25670) A use-after-free flaw was found in the Linux kernel's NFC LLCP p ...

A race condition was found in the Linux kernel in sctp_destroy_sock If sctp_destroy_sock is called without sock_net(sk)->sctpaddr_wq_lock held and sp->do_auto_asconf is true, then an element is removed from the auto_asconf_splist without any proper locking ...

Hi, On Sun, Apr 18, 2021 at 11:41:06AM +0300, Or Cohen wrote: It looks that additionally gitkernelorg/linus/34e5b01186858b36c4d7c87e1a025071e8e2401f refer to CVE-2021-23133 Are both commits necessary? Regards, Salvatore ...

Hello, This is an announcement about CVE-2021-23133 which is a race-condition I found in Linux kernel sctp sockets (net/sctp/socketc) It can lead to kernel privilege escalation from the context of a network service or from an unprivileged process if certain conditions are met The bug was fixed on April 13, 2021: gitkernelorg/pub/scm/ ...

Hi Alex, On Mon, May 10, 2021 at 03:28:02PM +0930, Alex Murray wrote: Ah right, I missed the revert of the original commit Thanks for pointing that to me Regards, Salvatore ...

On Mon, 2021-05-10 at 13:54:43 +0930, Salvatore Bonaccorso wrote: It seems b166a20b07382b8bc1dcee2a448715c9c2c81b5b got reverted in the follow-up commit gitkernelorg/pub/scm/linux/kernel/git/torvalds/linuxgit/commit/net/sctp/socketc?id=01bfe5e8e428b475982a98a46cca5755726f3f7f and so 34e5b01186858b36c4d7c87e1a025071e8e2401f would appe ...

On Mon, 2021-05-10 at 15:40:53 +0930, Salvatore Bonaccorso wrote: No worries - thanks for pointing out the new commit otherwise I wouldn't have gone investigating to find the revert ;) ...

CWE-362 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b166a20b07382b8bc1dcee2a448715c9c2c81b5b https://www.openwall.com/lists/oss-security/2021/04/18/2 http://www.openwall.com/lists/oss-security/2021/05/10/1 http://www.openwall.com/lists/oss-security/2021/05/10/2 http://www.openwall.com/lists/oss-security/2021/05/10/3 http://www.openwall.com/lists/oss-security/2021/05/10/4 https://security.netapp.com/advisory/ntap-20210611-0008/https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2021-1503.html

CVE-2021-23133

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect