CVE-2021-23133: Linux Kernel sctp_destroy_sock race condition
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctpdestroysock is called without socknet(sk)->sctp.addrwqlock then an element is removed from the autoasconfsplist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPFCGROUPINETSOCKCREATE is attached which denies creation of some SCTP socket.
Other sources
A use-after-free flaw was found in the Linux kernel's SCTP socket functionality that triggers a race condition. This flaw allows a local user to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.12 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 5.12-rc8 - Compensating control
Mitigation: prevent the kernel module "sctp" from being loaded (blacklist the "sctp" kernel module) to prevent the vulnerable SCTP code from running; this is described as being so by default for Red Hat Enterprise Linux 8.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-23133?
CVE-2021-23133 has a high severity rating due to the potential for kernel privilege escalation.
How do I fix CVE-2021-23133?
To resolve CVE-2021-23133, upgrade to the kernel versions 0:4.18.0-348.rt7.130.el8 or 0:4.18.0-348.el8 on Red Hat systems.
Which Linux versions are affected by CVE-2021-23133?
CVE-2021-23133 affects Linux kernel versions prior to 5.12-rc8, including several versions between 4.10 and 5.11.
What type of vulnerability is CVE-2021-23133?
CVE-2021-23133 is classified as a race condition vulnerability in SCTP sockets of the Linux kernel.
Can CVE-2021-23133 be exploited by unprivileged users?
Yes, CVE-2021-23133 can potentially be exploited by unprivileged users or network services to escalate their privileges.