CVE-2021-23133

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-23133
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://www.openwall.com/lists/oss-security/2021/05/10/1 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/2 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/3 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/4 Mailing List Patch Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b166a20b07382b8bc1dcee2a448715c9c2c81b5b Mailing List Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html Mitigation Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html Mitigation Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/
https://security.netapp.com/advisory/ntap-20210611-0008/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/04/18/2 Exploit Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/1 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/2 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/3 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/4 Mailing List Patch Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b166a20b07382b8bc1dcee2a448715c9c2c81b5b Mailing List Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html Mitigation Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html Mitigation Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/
https://security.netapp.com/advisory/ntap-20210611-0008/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/04/18/2 Exploit Mailing List Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:broadcom:brocade_fabric_operating_system:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*
History

21 Nov 2024, 05:51

Type Values Removed Values Added
CVSS v2 : 6.9
v3 : 7.0 		v2 : 6.9
v3 : 6.7
References () http://www.openwall.com/lists/oss-security/2021/05/10/1 - Mailing List, Patch, Third Party Advisory () http://www.openwall.com/lists/oss-security/2021/05/10/1 - Mailing List, Patch, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2021/05/10/2 - Mailing List, Patch, Third Party Advisory () http://www.openwall.com/lists/oss-security/2021/05/10/2 - Mailing List, Patch, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2021/05/10/3 - Mailing List, Patch, Third Party Advisory () http://www.openwall.com/lists/oss-security/2021/05/10/3 - Mailing List, Patch, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2021/05/10/4 - Mailing List, Patch, Third Party Advisory () http://www.openwall.com/lists/oss-security/2021/05/10/4 - Mailing List, Patch, Third Party Advisory
References () https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b166a20b07382b8bc1dcee2a448715c9c2c81b5b - Mailing List, Patch, Vendor Advisory () https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b166a20b07382b8bc1dcee2a448715c9c2c81b5b - Mailing List, Patch, Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html - Mitigation, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html - Mitigation, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - Mitigation, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - Mitigation, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/ -
References () https://security.netapp.com/advisory/ntap-20210611-0008/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20210611-0008/ - Third Party Advisory
References () https://www.openwall.com/lists/oss-security/2021/04/18/2 - Exploit, Mailing List, Patch, Third Party Advisory () https://www.openwall.com/lists/oss-security/2021/04/18/2 - Exploit, Mailing List, Patch, Third Party Advisory

07 Nov 2023, 03:30

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/', 'name': 'FEDORA-2021-a963f04012', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/', 'name': 'FEDORA-2021-8cd093f639', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/', 'name': 'FEDORA-2021-e6b4847979', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/ -

28 Jul 2023, 19:34

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.12:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc5:*:*:*:*:*:*
Information

Published : 2021-04-22 18:15

Updated : 2024-11-21 05:51

NVD link : CVE-2021-23133

Mitre link : CVE-2021-23133

CVE.ORG link : CVE-2021-23133

JSON object : View

Products Affected

netapp

  • h300s_firmware
  • h700e_firmware
  • h410s_firmware
  • h410c_firmware
  • h300e
  • h300s
  • h700s
  • cloud_backup
  • solidfire_\&_hci_management_node
  • h500e_firmware
  • h300e_firmware
  • solidfire_baseboard_management_controller
  • h410c
  • h410s
  • h500s_firmware
  • h700e
  • h500s
  • h500e
  • h700s_firmware
  • solidfire_baseboard_management_controller_firmware

fedoraproject

  • fedora

broadcom

  • brocade_fabric_operating_system

linux

  • linux_kernel

debian

  • debian_linux
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024