Skip to content
OpenAdvisories
Medium · 6.7 CVE-2021-23133 EUVD-2021-10251GHSA-hp5q-cmxv-w64v

Linux Kernel sctp_destroy_sock race condition

Published Apr 22, 2021 · Updated Sep 16, 2024 · Assigned by palo_alto

Description

A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.

Affected products

VendorProductAffectedFixed
Linux Kernel Linux Kernel unspecified – < 5.12-rc8 5.12-rc8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 5.10.38-1 —
Debian 13 linux 5.10.38-1 —
Debian 12 linux 5.10.38-1 —
Debian 9 linux 4.9.272-1 DLA-2689-1
Debian 9 linux-4.19 4.19.194-1~deb9u1 DLA-2690-1
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-raspi-realtime No fix yet —
Ubuntu 22.04 LTS linux-realtime +2 No fix yet —
Ubuntu 20.04 LTS linux 5.4.0-77.86 USN-5000-1
Ubuntu 20.04 LTS linux-aws +1 5.4.0-1051.53 USN-5000-1
Ubuntu 20.04 LTS linux-aws-5.8 5.8.0-1038.40~20.04.1 USN-4999-1
Ubuntu 20.04 LTS linux-azure-5.8 5.8.0-1036.38~20.04.1 USN-4999-1
Ubuntu 20.04 LTS linux-bluefield 5.4.0-1013.16 —
Ubuntu 20.04 LTS linux-gcp 5.4.0-1046.49 USN-5000-1
Ubuntu 20.04 LTS linux-gcp-5.8 5.8.0-1035.37~20.04.1 USN-4999-1
Ubuntu 20.04 LTS linux-gke 5.4.0-1046.48 USN-5000-1
Ubuntu 20.04 LTS linux-gkeop 5.4.0-1018.19 USN-5000-1
Ubuntu 20.04 LTS linux-hwe-5.8 5.8.0-59.66~20.04.1 USN-4999-1
Ubuntu 20.04 LTS linux-kvm 5.4.0-1041.42 USN-5000-2
Ubuntu 20.04 LTS linux-oem-5.10 5.10.0-1032.33 USN-5001-1
Ubuntu 20.04 LTS linux-oracle 5.4.0-1048.52 USN-5000-1
Ubuntu 20.04 LTS linux-oracle-5.8 5.8.0-1033.34~20.04.1 USN-4999-1
Ubuntu 20.04 LTS linux-raspi 5.4.0-1038.41 USN-5000-1
Ubuntu 20.04 LTS linux-riscv +2 No fix yet —
Ubuntu 20.04 LTS linux-riscv-5.8 5.8.0-29.31~20.04.1 —
Ubuntu 18.04 LTS linux 4.15.0-147.151 USN-5003-1
Ubuntu 18.04 LTS linux-aws 4.15.0-1106.113 USN-5003-1
Ubuntu 18.04 LTS linux-aws-5.4 +1 5.4.0-1051.53~18.04.1 USN-5000-1
Ubuntu 18.04 LTS linux-azure-4.15 4.15.0-1118.131 USN-5003-1
Ubuntu 18.04 LTS linux-dell300x 4.15.0-1022.26 USN-5003-1
Ubuntu 18.04 LTS linux-gcp +13 No fix yet —
Ubuntu 18.04 LTS linux-gcp-4.15 4.15.0-1103.116 USN-5003-1
Ubuntu 18.04 LTS linux-gcp-5.4 5.4.0-1046.49~18.04.1 USN-5000-1
Ubuntu 18.04 LTS linux-gke-5.4 5.4.0-1046.48~18.04.1 USN-5000-1
Ubuntu 18.04 LTS linux-gkeop-5.4 5.4.0-1018.19~18.04.1 USN-5000-1
Ubuntu 18.04 LTS linux-hwe-5.4 5.4.0-77.86~18.04.1 USN-5000-1
Ubuntu 18.04 LTS linux-kvm 4.15.0-1094.96 —
Ubuntu 18.04 LTS linux-oracle 4.15.0-1075.83 USN-5003-1
Ubuntu 18.04 LTS linux-oracle-5.4 5.4.0-1048.52~18.04.1 USN-5000-1
Ubuntu 18.04 LTS linux-raspi-5.4 5.4.0-1038.41~18.04.1 USN-5000-1
Ubuntu 18.04 LTS linux-raspi2 4.15.0-1089.94 USN-5003-1
Ubuntu 18.04 LTS linux-snapdragon 4.15.0-1106.115 USN-5003-1
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 20.04 LTS linux-aws-fips 5.4.0-1069.73+fips2 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-azure-fips 5.4.0-1073.76+fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips 5.4.0-1028.32 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-gcp-fips 5.4.0-1067.71~20.04.1 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-aws-fips 4.15.0-2048.50 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-azure-fips 4.15.0-2030.33 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-fips 4.15.0-1063.71 —
Ubuntu Pro 16.04 LTS linux-aws-hwe 4.15.0-1106.113~16.04.1 USN-5003-1
Ubuntu Pro 16.04 LTS linux-azure 4.15.0-1118.131~16.04.1 USN-5003-1
Ubuntu Pro 16.04 LTS linux-gcp 4.15.0-1103.116~16.04.1 USN-5003-1
Ubuntu Pro 16.04 LTS linux-hwe 4.15.0-147.151~16.04.1 USN-5003-1
Ubuntu Pro 16.04 LTS linux-oracle 4.15.0-1075.83~16.04.1 USN-5003-1
Ubuntu Pro 14.04 LTS linux-azure 4.15.0-1118.131~14.04.1 USN-5003-1
ReleasePackageFixed inAdvisory
RHEL 8 kernel-rt +12 4.18.0-348.rt7.130.el8 RHSA-2021:4140
RHEL 8 perf +26 4.18.0-348.el8 RHSA-2021:4356

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 kernel-tools-libs-devel 4.18.0-348.el8 ALSA-2021:4356
ReleasePackageFixed inAdvisory
SLES 15 SP1 kernel-docs +5 4.12.14-197.92.1 SUSE-SU-2021:1912-1
SLES 15 kernel-docs +6 4.12.14-150.75.1 SUSE-SU-2021:2421-1
SLES 12 SP5 kernel-azure +2 4.12.14-16.59.1 SUSE-SU-2021:1887-1
SLES 12 SP5 kernel-docs 4.12.14-122.74.2 SUSE-SU-2021:1913-1
SLES 12 SP5 kernel-syms +3 4.12.14-122.74.1 SUSE-SU-2021:1913-1
SLES 12 SP4 kernel-syms +2 4.12.14-95.77.1 SUSE-SU-2021:1891-1
Show 19 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP1 kernel-docs +4 4.12.14-197.92.1 SUSE-SU-2021:1912-1
SLES for SAP 15 kernel-docs +5 4.12.14-150.75.1 SUSE-SU-2021:2421-1
SLES for SAP 12 SP5 kernel-azure +2 4.12.14-16.59.1 SUSE-SU-2021:1887-1
SLES for SAP 12 SP5 kernel-syms +2 4.12.14-122.74.1 SUSE-SU-2021:1913-1
SLES for SAP 12 SP4 kernel-syms +2 4.12.14-95.77.1 SUSE-SU-2021:1891-1
SLE Real Time 12 SP5 kernel-rt +3 4.12.14-10.46.1 SUSE-SU-2021:1899-1
SLE Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_0 3-3.1 SUSE-SU-2021:2384-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_0 13-5.2 SUSE-SU-2021:2377-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_1 12-2.2 SUSE-SU-2021:2377-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_10 7-2.2 SUSE-SU-2021:2361-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_11 6-2.2 SUSE-SU-2021:2366-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_12 +1 3-2.1 SUSE-SU-2021:2384-1, SUSE-SU-2021:2366-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_15 2-2.1 SUSE-SU-2021:2577-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_2 +2 11-2.2 SUSE-SU-2021:2387-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_5 +2 9-2.2 SUSE-SU-2021:2387-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_8 +1 8-2.2 SUSE-SU-2021:2361-1
SLE Live Patching 15 SP1 kernel-default 4.12.14-197.92.1 SUSE-SU-2021:1912-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_13 +1 12-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_15 11-2.2 SUSE-SU-2021:2332-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_16 10-2.2 SUSE-SU-2021:2332-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_17 +1 9-2.2 SUSE-SU-2021:2332-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_19 +1 8-2.2 SUSE-SU-2021:2361-1, SUSE-SU-2021:2332-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_21 8-2.3 SUSE-SU-2021:2361-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_22 7-2.2 SUSE-SU-2021:2332-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_23 6-2.2 SUSE-SU-2021:2361-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_24 3-2.1 SUSE-SU-2021:2361-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_25 1-3.3.1 SUSE-SU-2021:1912-1
SLE Live Patching 15 kernel-default 4.12.14-150.75.1 SUSE-SU-2021:2421-1
SLE Live Patching 15 kernel-livepatch-SLE15_Update_19 12-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 15 kernel-livepatch-SLE15_Update_20 11-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 15 kernel-livepatch-SLE15_Update_21 9-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 15 kernel-livepatch-SLE15_Update_22 7-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 15 kernel-livepatch-SLE15_Update_23 6-2.2 SUSE-SU-2021:2367-1
SLE Live Patching 15 kernel-livepatch-SLE15_Update_24 3-2.1 SUSE-SU-2021:2367-1
SLE Live Patching 15 kernel-livepatch-SLE15_Update_25 1-1.3.1 SUSE-SU-2021:2421-1
SLE Live Patching 12 SP5 kernel-default 4.12.14-122.74.1 SUSE-SU-2021:1913-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_10 12-2.2 SUSE-SU-2021:2332-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_11 +1 10-2.2 SUSE-SU-2021:2453-1, SUSE-SU-2021:2361-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_13 +1 8-2.2 SUSE-SU-2021:2453-1, SUSE-SU-2021:2332-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_15 7-2.2 SUSE-SU-2021:2361-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_16 6-2.2 SUSE-SU-2021:2332-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_17 4-2.2 SUSE-SU-2021:2460-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_18 3-2.1 SUSE-SU-2021:2366-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_19 1-8.3.1 SUSE-SU-2021:1913-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_7 +1 14-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_9 13-2.2 SUSE-SU-2021:2332-1
SLE Live Patching 12 SP4 kernel-default 4.12.14-95.77.1 SUSE-SU-2021:1891-1
SLE Live Patching 12 SP4 kgraft-patch-SLE12-SP4_Update_15 12-2.2 SUSE-SU-2021:2367-1
SLE Live Patching 12 SP4 kgraft-patch-SLE12-SP4_Update_16 11-2.2 SUSE-SU-2021:2367-1
SLE Live Patching 12 SP4 kgraft-patch-SLE12-SP4_Update_17 8-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 12 SP4 kgraft-patch-SLE12-SP4_Update_18 7-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 12 SP4 kgraft-patch-SLE12-SP4_Update_19 6-2.2 SUSE-SU-2021:2344-1
SLE Live Patching 12 SP4 kgraft-patch-SLE12-SP4_Update_20 3-2.1 SUSE-SU-2021:2367-1
SLE Live Patching 12 SP4 kgraft-patch-SLE12-SP4_Update_21 1-6.3.1 SUSE-SU-2021:1891-1
SLE HPC 15 SP1 kernel-docs +4 4.12.14-197.92.1 SUSE-SU-2021:1912-1
SLE HPC 15 kernel-docs +5 4.12.14-150.75.1 SUSE-SU-2021:2421-1
SUSE OpenStack Cloud Crowbar 9 kernel-syms +2 4.12.14-95.77.1 SUSE-SU-2021:1891-1
SUSE OpenStack Cloud 9 kernel-syms +2 4.12.14-95.77.1 SUSE-SU-2021:1891-1
SUSE Manager Server 4.0 kernel-docs +5 4.12.14-197.92.1 SUSE-SU-2021:1912-1
SUSE Manager Retail Branch Server 4.0 kernel-docs +4 4.12.14-197.92.1 SUSE-SU-2021:1912-1
SUSE Manager Proxy 4.0 kernel-docs +4 4.12.14-197.92.1 SUSE-SU-2021:1912-1
SUSE Enterprise Storage 6 kernel-docs +4 4.12.14-197.92.1 SUSE-SU-2021:1912-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed kernel-source 5.14.6-1.4 openSUSE-SU-2024:13704-1, openSUSE-SU-2024:10728-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 kernel-livepatch-4.14.232-176.381 1.0-0.amzn2 ALAS2-2021-1636
Amazon Linux 2 perf +8 4.14.232-176.381.amzn2 ALAS2-2021-1636

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) kernel 5.10.78.1-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 perf +19 4.18.0-348.el8 ELSA-2021-4356
Oracle Linux 7 kernel-uek-container 4.14.35-2047.505.4.el7 ELSA-2021-9363, ELSA-2021-9351, ELSA-2021-9307
Oracle Linux 7 kernel-uek-container-debug 5.4.17-2102.202.5.el8 ELSA-2021-9363, ELSA-2021-9307
Oracle Linux 7 perf +10 4.14.35-2047.505.4.el7uek ELSA-2021-9362, ELSA-2021-9349, ELSA-2021-9306

Advisories 38

References