Vulnerability · Published May 11, 2021 · Assigned by mitre
CVE-2021-32606
High 7.8
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.4%top 62.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
Affected products (as reported)
References
- https://www.openwall.com/lists/oss-security/2021/05/11/16
- [oss-security] 20210512 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation mailing-list
- [oss-security] 20210514 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation mailing-list
- [oss-security] 20210514 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation mailing-list
- FEDORA-2021-4f852b79d1 vendor-advisory
- FEDORA-2021-bae582b42c vendor-advisory
- FEDORA-2021-8832eab899 vendor-advisory
- [oss-security] 20210528 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation mailing-list
- https://security.netapp.com/advisory/ntap-20210625-0001/
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2b17c400aeb44daf041627722581ade527bb3c1d