CVE-2021-4001: Race Condition
A race condition was found in the Linux kernel's ebpf verifier between bpfmapupdateelem and bpfmapfreeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (capsysadmin or capbpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.
Other sources
A race problem is found in the ebpf verifier between bpfmapupdateelem and bpfmapfreeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (capsysadmin or capbpf) can modify the frozen mapped address space.
Reference and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.16 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.16 rc2Patch 353050be4c19e102178ccc05988101887c25ae53
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4001?
CVE-2021-4001 has been classified as a medium severity vulnerability.
How do I fix CVE-2021-4001?
To fix CVE-2021-4001, upgrade your kernel to version 5.16 or later for Red Hat or to the specified remedial versions for Debian.
Who is affected by CVE-2021-4001?
CVE-2021-4001 affects local users with special privileges, such as cap_sys_admin or cap_bpf, on specific versions of the Linux kernel.
What types of systems are vulnerable to CVE-2021-4001?
Systems running Linux kernel versions up to 5.15, including any pre-release versions like 5.16-rc1, are vulnerable to CVE-2021-4001.
Can I exploit CVE-2021-4001 without special privileges?
No, exploiting CVE-2021-4001 requires special privileges such as cap_sys_admin or cap_bpf.