CVE-2021-4203
A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.
- Score
- CVSS 3.1 6.8 Medium
- Status
- Modified - secalert@redhat.com
- Published
- 2022-03-25
- Last modified
- 2024-08-03
- Weaknesses
- CWE-362, CWE-416
Affected products
- Linux Kernel (Linux)
- A700s Firmware (Netapp)
- Active Iq Unified Manager (Netapp)
- Bootstrap Os (Netapp)
- E-series Santricity Os Controller (Netapp)
- Element Software (Netapp)
- H300s Firmware (Netapp)
- H410c Firmware (Netapp)
- H410s Firmware (Netapp)
- H500s Firmware (Netapp)
- H700s Firmware (Netapp)
- Hci Management Node (Netapp)
- Solidfire (Netapp)
- Communications Cloud Native Core Binding Support Function (Oracle)
- Communications Cloud Native Core Network Exposure Function (Oracle)
- Communications Cloud Native Core Policy (Oracle)
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2230&can=7&q=modified-after%3Atoday-30&sort=-modified&colspec…
- https://bugzilla.redhat.com/show_bug.cgi?id=2036934
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=35306eb23814
- https://lore.kernel.org/netdev/20210929225750.2548112-1-eric.dumazet%40gmail.com/T/
- https://security.netapp.com/advisory/ntap-20221111-0003/
- https://www.oracle.com/security-alerts/cpujul2022.html
