CVEvulnerability

CVE-2021-23133

7.0 HIGH Published 2021-04-22 Modified 2026-07-30 Official page ↗
Status
Analyzed
Published
2021-04-22
Last modified
2026-07-30
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.7 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-362

Description

A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.

Affected configurations

• linux linux kernel (< 4.4.269) • linux linux kernel (>= 4.5 < 4.9.269) • linux linux kernel (>= 4.10 < 4.14.233) • linux linux kernel (>= 4.15 < 4.19.191) • linux linux kernel (>= 4.20 < 5.4.119) • linux linux kernel (>= 5.5 < 5.10.37) • linux linux kernel (>= 5.11 < 5.11.21) • linux linux kernel (>= 5.12 < 5.12.4) • fedoraproject fedora 32 • fedoraproject fedora 33 • fedoraproject fedora 34 • debian debian linux 9.0 • netapp cloud backup • netapp solidfire \& hci management node • broadcom brocade fabric operating system • netapp h410c firmware • netapp h300s firmware • netapp h500s firmware • netapp h700s firmware • netapp h300e firmware • netapp h500e firmware • netapp h700e firmware • netapp h410s firmware • netapp solidfire baseboard management controller firmware

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References