Strix
26.1K

CVE-2021-4083

HIGHCVSS 7/10EPSS 0.31%

Last modified

CVE-2021-4083 is a high-severity vulnerability rated 7/10 on the CVSS scale. A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. EPSS estimates a 0.31% chance of exploitation in the next 30 days.

Description

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.

Metrics

CVSS 3.1
7/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.31%

23.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
LinuxLinux Kernel< 4.4.294—
LinuxLinux Kernel>= 4.5, < 4.9.292—
LinuxLinux Kernel>= 4.10, < 4.14.257—
LinuxLinux Kernel>= 4.15, < 4.19.220—
LinuxLinux Kernel>= 4.20, < 5.4.164—
LinuxLinux Kernel>= 5.5.0, < 5.10.84—
LinuxLinux Kernel>= 5.11, < 5.15.7—
LinuxLinux Kernel5.16Rc1
NetappH410c FirmwareAll versions—
NetappH300s FirmwareAll versions—
NetappH500s FirmwareAll versions—
NetappH700s FirmwareAll versions—
NetappH300e FirmwareAll versions—
NetappH500e FirmwareAll versions—
NetappH700e FirmwareAll versions—
NetappH410s FirmwareAll versions—
DebianDebian Linux9.0—
DebianDebian Linux10.0—
NetappHci Management NodeAll versions—
NetappSolidfireAll versions—
OracleCommunications Cloud Native Core Binding Support Function22.1.3—
OracleCommunications Cloud Native Core Network Exposure Function22.1.1—
OracleCommunications Cloud Native Core Policy22.2.0—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-4083?
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.
How severe is CVE-2021-4083?
CVE-2021-4083 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 0.31% probability of exploitation in the next 30 days.
How do I fix CVE-2021-4083?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-4083?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST