CVE-2021-39686: binder SELinux checks are racy wrt concurrent execve() in :linux_kernel:
Summary
CVE-2021-39686: In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. Affects :linux_kernel: versions >= :0, < :2022-03-05. Fixed in :2022-03-05. How to fix ↓
Also tracked for
- linux · Debian:11
The same CVE-2021-39686 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The :linux_kernel: package is an integral part of the Android ecosystem, responsible for providing the core functionality of the operating system. It includes various components and modules that enable communication between different processes. One of these components is binder.c, which handles inter-process communication (IPC) using the Binder mechanism. This vulnerability specifically affects the SELinux checks in binder.c, which are responsible for enforcing security policies and access controls.
Vulnerability Detail
The vulnerability arises due to a race condition in several functions of binder.c. This race condition can result in the wrong domain being represented to SELinux, potentially leading to a local escalation of privilege. Exploiting this vulnerability does not require any additional execution privileges or user interaction. The impact of this vulnerability can be severe, as it allows an attacker to gain elevated privileges on the affected system.
How To Fix
Minimum fixed version
:2022-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the available fixes by updating the :linux_kernel: package.
Conclusion
The CVE-2021-39686 vulnerability in the :linux_kernel: package's binder SELinux checks poses a significant risk of local privilege escalation. It is crucial to update the package to a fixed version released after March 5, 2022, to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for :linux_kernel: →
FAQ
This vulnerability allows an attacker to escalate their privileges on the affected system, potentially gaining full control over the device.
No, user interaction is not needed for exploitation. The vulnerability can be exploited locally without any additional execution privileges.
No, only versions released before March 5, 2022, are affected. It is recommended to update to a fixed version to mitigate the vulnerability.
SELinux (Security-Enhanced Linux) is a security module in the Linux kernel that provides access control and mandatory access control (MAC) policies. It helps enforce fine-grained security policies to protect the system from unauthorized access and privilege escalation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application or device is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
