CVE-2021-22600 Linux Kernel Privilege Escalation
A local attacker can exploit a double free bug in the Linux kernel packet socket implementation to escalate privileges or cause a denial of service.
- Exploited in the wild
- Since 11 Apr 2022
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-22600?
CVE-2021-22600 is a medium-severity use after free vulnerability in Debian Debian Linux, published on 26 Jan 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
Weakness: CWE-415
Which versions are affected by CVE-2021-22600?
It affects 11 products.
Products include Debian Debian Linux, Linux kernel, Netapp 8300 Firmware, Netapp 8700 Firmware, Netapp A400 Firmware, Netapp C400 Firmware and 5 more.
How do I fix CVE-2021-22600?
Upgrade to a fixed version. US federal agencies must fix it by 2 May 2022.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-22600 being exploited?
Yes. Attackers have exploited CVE-2021-22600 in the wild since at least 11 Apr 2022.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as A-213464034, ASB-A-213464034, AZL-8450, DEBIAN-CVE-2021-22600, GHSA-6rrc-7vqp-364c, PUB-A-213464034 and 1 more.