Vulnerability Description
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 5.5, < 5.10.13 |
| Netapp | Aff Baseboard Management Controller | - |
| Netapp | Cloud Backup | - |
| Netapp | Fas Baseboard Management Controller | - |
| Netapp | Solidfire \& Hci Management Node | - |
| Netapp | Solidfire Baseboard Management Controller | - |
| Netapp | Baseboard Management Controller 500F Firmware | < 15.3 |
| Netapp | 500F | - |
| Netapp | Baseboard Management Controller A250 Firmware | < 15.3 |
| Netapp | A250 | - |
| Netapp | Hci H410C Firmware | - |
| Netapp | Hci H410C | - |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2021/02/05/6Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/09/2Mailing List
- http://www.openwall.com/lists/oss-security/2022/01/25/14Mailing List
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.13Release NotesVendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5PatchVendor Advisory
- https://security.netapp.com/advisory/ntap-20210312-0008/PatchThird Party Advisory
- https://www.openwall.com/lists/oss-security/2021/02/04/5Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/02/05/6Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/09/2Mailing List
- http://www.openwall.com/lists/oss-security/2022/01/25/14Mailing List
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.13Release NotesVendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5PatchVendor Advisory
- https://security.netapp.com/advisory/ntap-20210312-0008/PatchThird Party Advisory
- https://www.openwall.com/lists/oss-security/2021/02/04/5Mailing ListPatchThird Party Advisory
FAQ
What is CVE-2021-26708?
CVE-2021-26708 is a vulnerability with a CVSS score of 7.0 (HIGH). A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The rac...
How severe is CVE-2021-26708?
CVE-2021-26708 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-26708?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Netapp Aff Baseboard Management Controller, Netapp Cloud Backup, Netapp Fas Baseboard Management Controller, Netapp Solidfire \& Hci Management Node.