CVE-2021-23133
Assigner: palo_alto
Published: 2021-04-13T00:00:00
State: PUBLISHED
affected: product: Linux Kernel
vendor: Linux Kernel
versions: lessThan: 5.12-rc8
status: affected
version: unspecified
versionType: custom
credits: value: Or Cohen from Palo Alto Networks
datePublic: 2021-04-13T00:00:00
descriptions: value: A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-362
description: CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)
type: CWE
solutions: value: This issue is fixed in Linux kernel 5.12-rc8.
source: discovery: EXTERNAL
title: Linux Kernel sctp_destroy_sock race condition
x_generator: engine: Vulnogram 0.0.9