CVEvulnerability

CVE-2021-4203

6.8 MEDIUM Published 2022-03-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0 ([email protected])
4.9 MEDIUM — AV:N/AC:M/Au:S/C:P/I:N/A:P
Weaknesses
CWE-362, CWE-416

Description

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.

Affected configurations

• linux linux kernel (< 5.15) • linux linux kernel 5.15 • netapp active iq unified manager • netapp e-series santricity os controller (>= 11.0.0 <= 11.70.2) • netapp element software • netapp hci management node • netapp solidfire • netapp bootstrap os • netapp a700s firmware • netapp h300s firmware • netapp h500s firmware • netapp h700s firmware • netapp h410s firmware • netapp h410c firmware • oracle communications cloud native core binding support function 22.1.3 • oracle communications cloud native core network exposure function 22.1.1 • oracle communications cloud native core policy 22.2.0

Related

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-416 Use After Free weakness

References