CVE-2021-22600: Double Free in net/packet/af_packet.c leading to priviledge escalation
A double free bug in packetsetring() in net/packet/afpacket.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
Other sources
Linux Kernel contains a flaw in the packet socket (AFPACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.135-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 - Upgrade
Upgrade
Androidto a version that resolves this vulnerability.Patch ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 - Upgrade
Upgrade
Red Hat Kernel-develto a version that resolves this vulnerability.Patch ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
Event History
Frequently Asked Questions
What is the severity of CVE-2021-22600?
CVE-2021-22600 has a high severity rating as it allows local users to escalate privileges or cause denial of service.
How do I fix CVE-2021-22600?
To fix CVE-2021-22600, upgrade your kernel to a version later than those specifically affected or rebuild after commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755.
Which systems are affected by CVE-2021-22600?
CVE-2021-22600 affects various Linux Kernel versions ranging from 4.14.175 to 4.14.259, 4.19.114 to 4.19.222, 5.4.29 to 5.4.168, 5.5.14 to 5.10.88, and 5.11 to 5.15.11, as well as Debian 9 and 10.
What type of vulnerability is CVE-2021-22600?
CVE-2021-22600 is categorized as a double free vulnerability in the kernel's packet_set_ring() function.
Can CVE-2021-22600 be exploited remotely?
CVE-2021-22600 cannot be exploited remotely; it requires local user access for exploitation.