CVE-2021-0920: Android Kernel Race Condition Vulnerability

Published Jul 28, 2021
·
Updated

A flaw was found in the linux kernel, unixgc() assumes that candidate sockets can never gain an external reference (i.e. be installed into an fd) while the unixgclock is held. Except for MSGPEEK this is guaranteed by modifying inflight count under the unixgclock.

References:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca

Other sources

A vulnerability was found in unixdgramrecvmsg in net/unix/afunix.c in the Linux kernel's garbage collection for Unix domain socket file handlers. In this flaw, a missing cleanup may lead to a use-after-free due to a race problem. This flaw allows a local user to crash the system or escalate their privileges on the system. A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system.

Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.

— CISA

Google Android could allow a local attacker to gain elevated privileges on the system, caused by a use after free flaw due to a race condition in unixscmtoskb of afunix.c. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.

— IBM

In unixscmtoskb of afunix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

Affected Software

29 affected componentsFixes available
redhat/kernel<0:2.6.32-754.47.1.el6
0:2.6.32-754.47.1.el6
redhat/kernel-rt<0:3.10.0-1160.59.1.rt56.1200.el7
0:3.10.0-1160.59.1.rt56.1200.el7
redhat/kernel<0:3.10.0-1160.59.1.el7
0:3.10.0-1160.59.1.el7
redhat/kernel<0:3.10.0-514.99.1.el7
0:3.10.0-514.99.1.el7
redhat/kernel<0:3.10.0-693.99.1.el7
0:3.10.0-693.99.1.el7
redhat/kernel<0:3.10.0-957.92.1.el7
0:3.10.0-957.92.1.el7
redhat/kernel<0:3.10.0-1062.66.1.el7
0:3.10.0-1062.66.1.el7
redhat/kernel-rt<0:4.18.0-348.20.1.rt7.150.el8_5
0:4.18.0-348.20.1.rt7.150.el8_5
redhat/kernel<0:4.18.0-348.20.1.el8_5
0:4.18.0-348.20.1.el8_5
redhat/kernel<0:4.18.0-147.64.1.el8_1
0:4.18.0-147.64.1.el8_1
redhat/kernel-rt<0:4.18.0-193.75.1.rt13.125.el8_2
0:4.18.0-193.75.1.rt13.125.el8_2
redhat/kernel<0:4.18.0-193.75.1.el8_2
0:4.18.0-193.75.1.el8_2
redhat/kernel-rt<0:4.18.0-305.40.1.rt7.112.el8_4
0:4.18.0-305.40.1.rt7.112.el8_4
redhat/kernel<0:4.18.0-305.40.1.el8_4
0:4.18.0-305.40.1.el8_4
redhat/redhat-virtualization-host<0:4.3.22-20220330.1.el7_9
0:4.3.22-20220330.1.el7_9
redhat/kernel<5.14
5.14
Android Kernel
IBM BM Security Guardium<=11.3
IBM Security Guardium<=11.4
IBM Security Guardium<=11.5
Google Android
Google Android
Debian Debian Linux=9.0
Linux Linux kernel<=5.13
Linux Linux kernel=5.14-rc1
Linux Linux kernel=5.14-rc2
Linux Linux kernel=5.14-rc3
Google Android
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.22-16.12.25-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:2.6.32-754.47.1.el6
  2. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.59.1.rt56.1200.el7
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.59.1.el7
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-514.99.1.el7
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-693.99.1.el7
  6. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-957.92.1.el7
  7. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1062.66.1.el7
  8. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-348.20.1.rt7.150.el8_5
  9. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-348.20.1.el8_5
  10. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-147.64.1.el8_1
  11. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-193.75.1.rt13.125.el8_2
  12. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-193.75.1.el8_2
  13. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-305.40.1.rt7.112.el8_4
  14. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-305.40.1.el8_4
  15. Upgrade

    Upgrade redhat/redhat-virtualization-host to a version that resolves this vulnerability.

    Fixed in 0:4.3.22-20220330.1.el7_9
  16. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
  17. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 5.14
  18. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1
  19. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.234-1
  20. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.129-1
  21. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.135-1
  22. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.12.22-1
  23. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.12.25-1

Event History

Jul 28, 2021
CVE Published
12:00 AM
Dec 13, 2021
Data Sourced
via Red Hat·06:03 PM
DescriptionSeverityAffected Software
Dec 15, 2021
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
May 23, 2022
Known Exploited
via CISA·12:00 AM
Jan 11, 2024
Data Sourced
via Launchpad·11:53 PM
Description
Apr 28, 2025
Data Sourced
via Ubuntu·03:47 AM
RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-0920?

CVE-2021-0920 has a severity rating of medium, indicating it may allow a user to perform unauthorized operations in certain conditions.

2

How do I fix CVE-2021-0920?

To fix CVE-2021-0920, update the kernel to the specified remedial versions mentioned in the advisory.

3

What systems are affected by CVE-2021-0920?

CVE-2021-0920 affects various versions of the Linux kernel across different distributions such as Red Hat and Debian.

4

Can CVE-2021-0920 be exploited remotely?

CVE-2021-0920 does not grant remote exploitation capabilities and requires local access to exploit.

5

What conditions make CVE-2021-0920 a risk?

CVE-2021-0920 becomes a risk when system configurations allow untrusted users local access to the system.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203