CVE-2021-26708: Race Condition
A flaw was found in the Linux kernel. Wrong locking in the AFVSOCK socket can cause a local privilege escalation, bypassing SMEP and SMAP. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AFVSOCK implementation are caused by wrong locking in net/vmwvsock/afvsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
A vulnerability was found in Linux Kernel, where race conditions caused by wrong locking in net/vmwvsock/afvsock.c
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c518adafa39f37858697ac9309c6cf1805581446
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.22.1.rt7.77.el8_3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.22.1.el8_3 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.10.13Patch c518adafa39f37858697ac9309c6cf1805581446
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-26708?
The severity of CVE-2021-26708 is high with a severity value of 7.
How does CVE-2021-26708 affect the Linux kernel?
CVE-2021-26708 is a local privilege escalation vulnerability that affects the Linux kernel before version 5.10.13.
What is the impact of CVE-2021-26708?
CVE-2021-26708 can be exploited by an attacker with local access to escalate their privileges on a vulnerable system.
How can I fix CVE-2021-26708?
Apply the latest security patches or upgrade to a version of the Linux kernel that is not affected by CVE-2021-26708.
Where can I find more information about CVE-2021-26708?
Additional information about CVE-2021-26708 can be found in the references provided: [Reference 1](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c518adafa39f37858697ac9309c6cf1805581446), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1925595), [Reference 3](https://www.openwall.com/lists/oss-security/2021/02/04/5).