CVE-2021-4083: Linux kernel vulnerability in fget() of file.c
Summary
CVE-2021-4083: Linux kernel vulnerability advisory. Affects :linux_kernel: versions >= :0, < :2022-09-05. Fixed in :2022-09-05. How to fix ↓
Also tracked for
- linux · Debian:11
The same CVE-2021-4083 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system. It provides essential functionality for the system, including process management, memory management, and device drivers. The fget() function in file.c is responsible for obtaining a file pointer from a file descriptor. This vulnerability in fget() introduces a race condition that can result in a read after free, potentially leading to local escalation of privilege. Exploitation of this vulnerability does not require user interaction.
Vulnerability Detail
The vulnerability in fget() of file.c is caused by a race condition, where a file pointer is accessed after it has been freed. This can be exploited by an attacker to gain elevated privileges on the system. The impact of this vulnerability is significant as it allows an attacker to escalate their privileges without requiring any additional execution privileges. The vulnerability has been assigned the CVE identifier CVE-2021-4083.
How To Fix
Minimum fixed version
:2022-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix by updating the Linux kernel to a patched version.
Conclusion
The vulnerability in fget() of file.c in the Linux kernel can lead to local escalation of privilege. It is important to update the Linux kernel to a version that includes the necessary patches to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for :linux_kernel: →
FAQ
This vulnerability allows an attacker to escalate their privileges on the system without requiring any additional execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
The CVE identifier for this vulnerability is CVE-2021-4083.
To fix this vulnerability, update the Linux kernel to a version that includes the necessary patches.
No specific workaround has been provided. It is recommended to update the Linux kernel to a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
