MEDIUM

CVE-2021-0920

Linux Linux Kernel 2021-12-15 CVSS v3.1

CVSS

6.4

KEV

Description

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

Summary dbcve.org

A race condition in the unix_scm_to_skb function within af_unix.c creates a use-after-free vulnerability in the Linux kernel's AF_UNIX socket implementation. This local privilege escalation bug requires the attacker to already have System execution privileges on the device and does not require user interaction.

Mitigation

Apply the upstream kernel patch for this vulnerability; Android devices require a kernel update from the device manufacturer. Consider kernel hardening mechanisms (e.g., KASLR, SELinux policies) as defense-in-depth while awaiting the patch.

Weakness (CWE)

CWE-362 Race Condition

CWE-416 Use After Free

EPSS Score

0.82%

Probability of exploitation in next 30 days

55.4th percentile

References

https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html Mailing List, Third Party Advisory https://source.android.com/security/bulletin/2021-11-01 Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-0920 Third Party Advisory, US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE