Now-fixed Linux kernel vulnerabilities enabled local privilege escalation (CVE-2021-26708)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26708 | A local privilege escalation was discovered in the Linux kernel before 5.10.13. A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support. NVD description · AI analysis pending | 7.0 | 2% |
| — |
Full article188 words · extracted from helpnetsecurity.com · click to collapse
Security researcher Alexander Popov has discovered and fixed five similar issues in the virtual socket implementation of the Linux kernel.
The vulnerabilities could be exploited for local privilege escalation, as confirmed in experiments on Fedora 33 Server. The vulnerabilities, known together as CVE-2021-26708, have received a CVSS v3 base score of 7.0 (high severity).
These vulnerabilities result from race conditions that were implicitly added with virtual socket multi-transport support. They appeared in Linux kernel version 5.5 in November 2019. The vulnerable kernel drivers (CONFIG_VSOCKETS and CONFIG_VIRTIO_VSOCKETS) are shipped as kernel modules in all major GNU/Linux distributions. The vulnerable modules are automatically loaded when an AF_VSOCK socket is created. This ability is available to unprivileged users.
“I successfully developed a prototype exploit for local privilege escalation on Fedora 33 Server, bypassing x86_64 platform protections such as SMEP and SMAP. This research will lead to new ideas on how to improve Linux kernel security,” said Popov.
The researcher prepared the fixing patch and disclosed the vulnerabilities responsibly to the Linux kernel security team. The patch has been merged into mainline kernel version 5.11-rc7 and backported into affected stable trees.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/03/03/cve-2021-26708/