CVE-2021-23133

Name
CVE-2021-23133
Description
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
CONFIRM https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b166a20b07382b8bc1dcee2a448715c9c2c81b5b
CONFIRM https://www.openwall.com/lists/oss-security/2021/04/18/2
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/
MLIST http://www.openwall.com/lists/oss-security/2021/05/10/1
MLIST http://www.openwall.com/lists/oss-security/2021/05/10/2
MLIST http://www.openwall.com/lists/oss-security/2021/05/10/3
MLIST http://www.openwall.com/lists/oss-security/2021/05/10/4
CONFIRM https://security.netapp.com/advisory/ntap-20210611-0008/
MLIST https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
MLIST https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* linux_kernel >= None < 5.12

Vulnerable and fixed packages

Source package Branch Version Maintainer Status