Bug 2036934 (CVE-2021-4203) - CVE-2021-4203 kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses
Summary: CVE-2021-4203 kernel: Race condition in races in sk_peer_pid and sk_peer_cred...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-4203
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2037781 2037782 2037783 2081298 2081299 2081300 2081301
Blocks: 2036935 2038883
TreeView+ depends on / blocked
 
Reported: 2022-01-04 13:05 UTC by Pedro Sampaio
Modified: 2022-07-27 17:36 UTC (History)
49 users (show)

Fixed In Version: kernel 5.15 rc4
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.
Clone Of:
Environment:
Last Closed: 2022-05-11 14:16:20 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:2229 0 None None None 2022-05-12 11:27:08 UTC
Red Hat Product Errata RHBA-2022:4630 0 None None None 2022-05-18 11:46:51 UTC
Red Hat Product Errata RHBA-2022:4693 0 None None None 2022-05-19 05:11:20 UTC
Red Hat Product Errata RHBA-2022:4969 0 None None None 2022-06-08 18:40:29 UTC
Red Hat Product Errata RHBA-2022:5088 0 None None None 2022-06-16 11:23:50 UTC
Red Hat Product Errata RHBA-2022:5744 0 None None None 2022-07-27 17:36:50 UTC
Red Hat Product Errata RHSA-2022:1975 0 None None None 2022-05-10 14:40:49 UTC
Red Hat Product Errata RHSA-2022:1988 0 None None None 2022-05-10 14:46:52 UTC
Red Hat Product Errata RHSA-2022:5626 0 None None None 2022-07-19 21:06:08 UTC
Red Hat Product Errata RHSA-2022:5633 0 None None None 2022-07-19 21:07:53 UTC

Description Pedro Sampaio 2022-01-04 13:05:04 UTC 
A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect())  in the Linux kernel. In this flaw, an attacker with a user privilege may lead to a system crash or a leak of internal kernel information.

In this, if the creds are replaced and freed at the wrong time, a use-after-free read occurs.

References:

https://lore.kernel.org/netdev/20210929225750.2548112-1-eric.dumazet@gmail.com/T/
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=35306eb23814
https://bugs.chromium.org/p/project-zero/issues/detail?id=2230&can=7&q=modified-after%3Atoday-30&sort=-modified&colspec=ID%20Type%20Status%20Priority%20Milestone%20Owner%20Summary%20Modified%20Cve&cells=tiles&redir=1
Comment 12 errata-xmlrpc 2022-05-10 14:40:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1975 https://access.redhat.com/errata/RHSA-2022:1975
Comment 13 errata-xmlrpc 2022-05-10 14:46:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1988 https://access.redhat.com/errata/RHSA-2022:1988
Comment 14 Product Security DevOps Team 2022-05-11 14:16:16 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-4203
Comment 15 errata-xmlrpc 2022-07-19 21:06:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:5626 https://access.redhat.com/errata/RHSA-2022:5626
Comment 16 errata-xmlrpc 2022-07-19 21:07:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:5633 https://access.redhat.com/errata/RHSA-2022:5633
Note You need to log in before you can comment on or make changes to this bug.