CVE-2021-41073: High severity Linux Linux kernel vulnerability
Last updated 24 July 2024
Other sources
looprwiter in fs/iouring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORINGOPPROVIDEBUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
Mitigate local privilege escalation by restricting untrusted users from triggering io_uring operations (e.g., limit access to processes/containers that can issue IORING_OP_PROVIDE_BUFFERS).
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41073?
CVE-2021-41073 is considered to allow local users to gain elevated privileges, which is a serious security risk.
How do I fix CVE-2021-41073?
To fix CVE-2021-41073, update to the latest versions of the Linux kernel, specifically 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, or 6.12.10-1.
Which versions of the Linux kernel are affected by CVE-2021-41073?
The vulnerable versions of the Linux kernel are from 5.10 up to 5.14.6.
Who can be impacted by CVE-2021-41073?
Local users with unprivileged access could exploit CVE-2021-41073 to gain additional privileges on the system.
What happens if a system is compromised by CVE-2021-41073?
If a system is compromised through CVE-2021-41073, an attacker could execute arbitrary code with elevated privileges, posing a major security threat.