CVE-2021-4203

Katalog CVE

CVSS 6.8 · Medium EPSS 1,7%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada linux kernel, netapp active iq unified manager +14 lainnya. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.

Rincian

Terbit di NVD

25 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-416: Use After Free

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=35306eb23814 patch · advisory vendor
• https://bugs.chromium.org/p/project-zero/issues/detail?id=2230&can=7&q=modified-after%3Atoday-30&sort=-modifie... exploit · issue tracking · patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2036934 issue tracking · patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20221111-0003/ advisory pihak ketiga
• https://lore.kernel.org/netdev/20210929225750.2548112-1-eric.dumazet%40gmail.com/T/