What’s Vulnerable › Vulnerabilities
CVE-2021-4083
- Severity: high (CVSS 7.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-01-18 · updated 2026-06-17
- Weakness: CWE-416
Description
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.
Affected products
- Debian Linux: 9.0, 10.0
- Linux kernel: before 4.4.294; from 4.5 before 4.9.292; from 4.10 before 4.14.257; from 4.15 before 4.19.220; from 4.20 before 5.4.164; from 5.5.0 before 5.10.84 — fixed in 4.14.257, 4.19.220, 4.4.294, 4.9.292, 5.10.84, 5.15.7
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Hci Management Node: all versions
- NetApp Solidfire: all versions
- Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
- Oracle Communications Cloud Native Core Network Exposure Function: 22.1.1
- Oracle Communications Cloud Native Core Policy: 22.2.0
How to fix
Upgrade to a fixed version: Linux kernel 4.14.257, 4.19.220, 4.4.294, 4.9.292. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2029923
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
- https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://security.netapp.com/advisory/ntap-20220217-0005/
- https://www.debian.org/security/2022/dsa-5096
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2029923
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
- https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://security.netapp.com/advisory/ntap-20220217-0005/
Get alerted when CVE-2021-4083 or the next vulnerability affects your stack