CVE-2021-0920
Android Kernel Race Condition Vulnerability
Description
CVE-2021-0920 is a use-after-free vulnerability in the Android kernel caused by a race condition in the Unix domain socket garbage collection mechanism. The race condition allows for a use-after-free that can be exploited for local privilege escalation, granting an attacker kernel-level access on affected Android devices. No user interaction is required for exploitation. CVE-2021-0920 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and the EPSS percentile of 75.6% indicates significant exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | <= 5.13; 5.14 |
| android | - | |
| debian | debian linux | 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html(Mailing List, Third Party Advisory)
- https://source.android.com/security/bulletin/2021-11-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-0920(Third Party Advisory, US Government Resource)
Weakness Type
CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition')
CWE-362 describes a weakness where a product contains code that can execute concurrently but does not properly synchronize access to shared resources. In CVE-2021-0920, the Android kernel's Unix domain socket garbage collection mechanism contains a race condition that, when triggered, leads to a use-after-free condition that can be exploited for privilege escalation.
Learn more: CWE-362 — Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition')
Impact Analysis
CVE-2021-0920 enables local privilege escalation to kernel level on Android devices through a race condition in the Unix socket garbage collector. The vulnerability requires local code execution but no user interaction, meaning a malicious application can silently exploit it. Successful exploitation grants the attacker complete control over the device at the kernel level, bypassing all Android application sandbox restrictions and security controls. The EPSS percentile of 75.6% indicates significant real-world exploitation probability. CISA has confirmed active exploitation and added CVE-2021-0920 to the KEV catalog. The vulnerability affects the Linux kernel Unix socket subsystem, which means it potentially impacts not only Android devices but also other Linux-based systems using affected kernel versions.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-0920 in the wild and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 75.6% indicates significant exploitation probability. Google disclosed in the November 2021 Android security bulletin that this vulnerability may have been under limited, targeted exploitation. The vulnerability has been attributed to use in sophisticated, targeted attacks against specific individuals, consistent with the patterns seen in commercial spyware operations. The race condition nature of the vulnerability makes exploitation more complex than a simple memory corruption, but demonstrated real-world exploitation confirms that reliable exploit techniques have been developed.
Remediation
- Apply Android security updates as specified by the device manufacturer and Google. The November 2021 Android security patch level addresses CVE-2021-0920. This is the required action per CISA's KEV catalog.
- Ensure automatic security updates are enabled on all Android devices to receive kernel patches as soon as they are available.
- For Linux servers and workstations, apply kernel updates from your distribution that address the Unix domain socket race condition.
- Restrict the installation of applications to verified sources (Google Play Store) and enable Google Play Protect for automated malware scanning.
- Deploy mobile device management (MDM) solutions to enforce update compliance and monitor for indicators of kernel exploitation such as unexpected privilege escalation or jailbreak artifacts.
Technical Details
CVE-2021-0920 is a race condition vulnerability in the Linux kernel's Unix domain socket garbage collection mechanism. The garbage collector is responsible for cleaning up file descriptors passed through Unix sockets, but it contains a synchronization flaw classified under CWE-362. When multiple threads interact with Unix domain sockets simultaneously, a window exists where the garbage collector can free a file descriptor's associated memory while another thread still holds a reference to it, creating a use-after-free condition. An attacker with local code execution can repeatedly trigger this race condition until the freed memory is reallocated with attacker-controlled data, enabling kernel memory corruption and ultimately privilege escalation. The attack requires no user interaction once a malicious application is running. While the race condition makes exploitation non-deterministic, sophisticated attackers have demonstrated reliable exploitation through timing manipulation and memory layout techniques.
Frequently Asked Questions
Is CVE-2021-0920 being actively exploited?
Yes, CVE-2021-0920 has been actively exploited in targeted attacks. CISA has confirmed active exploitation and added it to the KEV catalog. Google noted potential limited, targeted exploitation in the November 2021 security bulletin. The EPSS percentile of 75.6% reflects significant exploitation probability.
What products are affected by CVE-2021-0920?
CVE-2021-0920 affects the Android kernel and potentially other Linux-based systems that use the affected Unix domain socket garbage collection code. The vulnerability is addressed in the November 2021 Android security patch level.
How do I fix CVE-2021-0920?
Apply the November 2021 or later Android security patch. For other Linux systems, apply kernel updates from your distribution. Enable automatic updates and use only trusted application sources. See the Remediation section for details.
How severe is CVE-2021-0920?
CVE-2021-0920 is a kernel race condition leading to use-after-free with an EPSS percentile of 75.6%. It enables local privilege escalation to kernel level without user interaction. While exploitation is more complex due to the race condition, demonstrated real-world use in targeted attacks confirms its severity for mobile and Linux security.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.