CVE-2021-3715: Use After Free
A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
A flaw was found in the way the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem handled changing of classification filters leading to user-after-free condition. An unprivileged local user could use this flaw to escalate their privileges on the system.
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ef299cc3fa1a9e1288665a9fdc8bff55629fd359
— Red Hat
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a use-after-free in route4change() in net/sched/clsroute.c. By sending a specially-crafted request, an attacker could exploit this vulnerability to escalate privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.42.2.rt56.1182.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.42.2.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.54.2.el8_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.65.2.rt13.117.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.65.2.el8_2 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.3.18-20210903.0.el7_9 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ef299cc3fa1a9e1288665a9fdc8bff55629fd359 - Configuration
Mitigate on Red Hat Enterprise Linux 8 by disabling unprivileged user namespaces: set user.max_user_namespaces to 0 (e.g., write /etc/sysctl.d/userns.conf with user.max_user_namespaces=0 and apply it with sysctl -p /etc/sysctl.d/userns.conf).
Linux kernel sysctl (user namespaces) user.max_user_namespaces = 0 - Compensating control
Mitigate by blacklisting the kernel module cls_route.ko so the affected Traffic Control "Routing decision" classifier code is not loaded (per Red Hat guidance for blacklisting kernel modules).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3715?
CVE-2021-3715 is a vulnerability in the Linux Kernel that could allow a local authenticated attacker to gain elevated privileges on the system.
What is the severity of CVE-2021-3715?
The severity of CVE-2021-3715 is high, with a severity value of 7.8.
How does CVE-2021-3715 affect the Linux Kernel?
CVE-2021-3715 affects the 'Routing decision' classifier in the Linux Kernel's Traffic Control networking subsystem, leading to a use-after-free condition.
Who is affected by CVE-2021-3715?
Unprivileged local users on systems running Linux Kernel versions 3.18 up to 5.10 are affected by CVE-2021-3715.
Are there any remedies or patches available for CVE-2021-3715?
Yes, remedies and patches are available. Please refer to the provided references for more information.