CVE-2021-4001

Katalog CVE

CVSS 4.1 · Medium EPSS 0,19%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada linux kernel. Skor CVSS 3.1 4.1 (Medium) menurut NVD.

Deskripsi (NVD)

A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.

Rincian

Terbit di NVD

21 Januari 2022

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

4.1 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2025645 issue tracking · patch · advisory pihak ketiga
• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae5... patch · advisory pihak ketiga