CVE-2021-3609: Race Condition
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
Other sources
A race condition occurs between bcmrelease() and bcmrxhandler(). When a message is received in bcmrxhandler(), the socket can be closed in bcmrelease() which will free the struct bcmsock and struct bcmop. This leads to various use-after-free's in bcmrxhandler() and depending on the provided flags, also in bcmrxtimeouthandler(). The use-after-free's in combination with a heap spray may lead to sensitive socket data being overwritten, resulting in local privilege escalation.
— Red Hat
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition in net/can/bcm.c. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges as root.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.12.1.rt7.84.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.12.1.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.54.2.el8_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.64.1.rt13.115.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.64.1.el8_2 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.4.7-20210804.0.el8_4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Add `install can-bcm /bin/true` to `/etc/modprobe.d/disable-can-bcm.conf` to prevent the CAN BCM module from loading.
Linux kernel CAN BCM module install can-bcm = /bin/true - Operational
Restart the system if the CAN modules are already loaded.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3609?
CVE-2021-3609 has been classified with a high severity level due to its potential for local privilege escalation.
How do I fix CVE-2021-3609?
To mitigate CVE-2021-3609, update to the latest kernel version as specified in the remediation instructions from your vendor.
What types of systems are affected by CVE-2021-3609?
CVE-2021-3609 affects various Linux kernel versions, particularly those in Red Hat and Debian distributions.
Can CVE-2021-3609 be exploited remotely?
No, CVE-2021-3609 requires local access for exploitation, making it a local privilege escalation vulnerability.
What happens if CVE-2021-3609 is successfully exploited?
If exploited, CVE-2021-3609 could lead to memory corruption, a system crash, or privilege escalation to root.