What’s Vulnerable › Vulnerabilities

CVE-2021-23133: Linux Kernel sctp_destroy_sock race condition

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-22 · updated 2026-07-30
• Weakness: CWE-362

Description

A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.

Affected products

• Broadcom Brocade Fabric Operating System: all versions
• Debian Linux: 9.0
• Fedoraproject Fedora: 32, 33, 34
• Linux kernel: before 4.4.269; from 4.5 before 4.9.269; from 4.10 before 4.14.233; from 4.15 before 4.19.191; from 4.20 before 5.4.119; from 5.5 before 5.10.37 — fixed in 4.14.233, 4.19.191, 4.4.269, 4.9.269, 5.10.37, 5.11.21
• NetApp Cloud Backup: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Solidfire & Hci Management Node: all versions
• NetApp Solidfire Baseboard Management Controller Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.233, 4.19.191, 4.4.269, 4.9.269. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/05/10/1
• http://www.openwall.com/lists/oss-security/2021/05/10/2
• http://www.openwall.com/lists/oss-security/2021/05/10/3
• http://www.openwall.com/lists/oss-security/2021/05/10/4
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b166a20b07382b8bc1dcee2a448715c9c2c81b5b
• https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
• https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CUX2CA63453G34C6KYVBLJXJXEARZI2X/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAEQ3H6HKNO6KUCGRZVYSFSAGEUX23JL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZASHZVCOFJ4VU2I3BN5W5EPHWJQ7QWX/
• https://security.netapp.com/advisory/ntap-20210611-0008/
• https://www.openwall.com/lists/oss-security/2021/04/18/2

Get alerted when CVE-2021-23133 or the next vulnerability affects your stack