CVE-2021-3847: linux-libc-dev Privilege Escalation
Summary
CVE-2021-3847: An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is an essential component for compiling and linking programs on Debian-based systems. The linux-libc-dev package contains header files and libraries necessary for developing programs that interact with the Linux kernel. This package is vulnerable to a privilege escalation vulnerability in the OverlayFS subsystem of the Linux kernel.
Vulnerability Detail
The vulnerability, identified as CVE-2021-3847, allows a low-privileged user to escalate their privileges on the system by exploiting a flaw in the execution of setuid files with capabilities. The vulnerability occurs when a user copies a capable file from a nosuid mount into another mount. By leveraging this flaw, a local user can gain elevated privileges, potentially leading to unauthorized access and control over the system. This vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and update the linux-libc-dev package to a patched version.
Conclusion
The linux-libc-dev package in the Debian operating system is vulnerable to a privilege escalation vulnerability. It is crucial to update the package to a patched version to mitigate the risk of unauthorized access and privilege escalation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is essential for compiling and linking programs on Debian-based systems.
This vulnerability allows a low-privileged user to escalate their privileges on the system, potentially leading to unauthorized access and control over the system.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to a version that includes the necessary security patches.
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and update the linux-libc-dev package to a patched version.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
