Vulnerability · Published Mar 3, 2022 · Assigned by redhat
CVE-2021-3609
High 7.0
In plain English
A high-severity race condition in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.0High
Exploit odds (30 days)0.4%top 62.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-305.12.1.el8_4 | ALSA-2021:3057 |
| Debian:12 | linux | 5.10.46-1 | DEBIAN-CVE-2021-3609 |
| Debian:13 | linux | 5.10.46-1 | DEBIAN-CVE-2021-3609 |
| Debian:14 | linux | 5.10.46-1 | DEBIAN-CVE-2021-3609 |
| Rocky Linux:8 | kernel | 0:4.18.0-305.12.1.el8_4 | RLSA-2021:3057 |
| Rocky Linux:8 | kernel-rt | 0:4.18.0-305.12.1.rt7.84.el8_4 | RLSA-2021:3088 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2021-3609 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2021-3609 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2021-3609 |
Affected products (as reported)
Weakness: CWE-362
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1971651 x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2021/06/19/1 x_refsource_MISC
- https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md x_refsource_MISC
- https://github.com/torvalds/linux/commit/d5f9023fa61ee8b94f37a93f08e94b136cf1e463 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220419-0004/ x_refsource_CONFIRM