CVE-2021-27216 Race condition in n/a

Medium 6.3 Published 6 May 2021 Updated 3 Aug 2024

A local attacker can exploit a race condition in Exim to delete arbitrary files as root, leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-27216?

CVE-2021-27216 is a medium-severity vulnerability in Exim Exim, published on 6 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.

Weakness: CWE-362

Which versions are affected by CVE-2021-27216?

It affects 1 product.

Products include Exim Exim.

How do I fix CVE-2021-27216?

Upgrade to a fixed version.

Is CVE-2021-27216 being exploited?

There is no known exploitation of CVE-2021-27216 in the wild and no public exploit code.

All Exim Exim vulnerabilities

Sources

Also known as CLEANSTART-2025-CS68584, DEBIAN-CVE-2021-27216, GHSA-3gw6-8wwv-rhr2, UBUNTU-CVE-2021-27216.