CVE-2021-3679: Medium severity Linux Linux kernel vulnerability
A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAPSYSADMIN capability) could use this flaw to starve the resources causing denial of service.
Other sources
A lack of CPU resources in the Linux kernel tracing module functionality was found in the way users use the trace ring buffer in specific way. Only privileged local users (with CAPSYSADMIN capability) could use this flaw to starve the resources causing denial of service.
Vulnerability in tracing module in kernel/trace/ringbuffer.c caused by a bug in rbpercpuempty() that uses a stale value and could cause tracingreadpipe() to be trapped in an event-polling loop infinitely.
The victim process (that is trapped) will always be in running state, drain a lot of power and cannot be killed by any UNIX signal (including SIGKILL). This vulnerability can be exploited merely using bash script, with sufficient privilege to control tracefs (like root or has CAPSYSADMIN capability).
Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=67f0d6d9883c13174669f88adac4f0ee656cc16a
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.14 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3679?
CVE-2021-3679 is classified as a high severity vulnerability that can lead to a denial of service.
How do I fix CVE-2021-3679?
To fix CVE-2021-3679, upgrade to kernel versions 5.14 or later, or the specific patched versions indicated for your distribution.
Who is affected by CVE-2021-3679?
CVE-2021-3679 affects privileged local users with CAP_SYS_ADMIN capability on Linux kernel versions prior to 5.14-rc3.
What kind of attack does CVE-2021-3679 facilitate?
CVE-2021-3679 facilitates denial of service attacks by allowing users to exhaust CPU resources in the tracing module.
Is CVE-2021-3679 specific to any Linux distributions?
CVE-2021-3679 impacts various distributions including Red Hat and Debian that have kernel versions prior to 5.14.