CVE-2021-22600
Linux Kernel Privilege Escalation Vulnerability
Description
CVE-2021-22600 is a double-free vulnerability in the Linux kernel's packet_set_ring() function within the network packet socket implementation. This flaw allows a local attacker to escalate privileges from an unprivileged user to root by exploiting the memory corruption caused by the double-free condition. The vulnerability affects multiple Linux kernel versions and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 0.3%, the probability of exploitation appears moderate, though confirmed real-world exploitation elevates its practical risk significantly.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netapp | 8300 firmware | - |
| netapp | 8700 firmware | - |
| netapp | a400 firmware | - |
| netapp | c400 firmware | - |
| linux | linux kernel | >= 4.14.175, < 4.14.259; >= 4.19.114, < 4.19.222; >= 5.4.29, < 5.4.168; >= 5.5.14, < 5.10.88; >= 5.11, < 5.15.11 |
| debian | debian linux | 9.0; 10.0 |
| netapp | h410c firmware | - |
| netapp | h300s firmware | - |
| netapp | h500s firmware | - |
| netapp | h700s firmware | - |
| netapp | h410s firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755(Mailing List, Patch)
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html(Mailing List, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20230110-0002/(Third Party Advisory)
- https://www.debian.org/security/2022/dsa-5096(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22600(US Government Resource)
Weakness Type
CWE-415: Double Free
A double-free vulnerability occurs when a program frees the same memory allocation twice, leading to memory corruption that can be exploited to execute arbitrary code or escalate privileges. In the context of CVE-2021-22600, the double-free in packet_set_ring() corrupts kernel heap metadata, enabling privilege escalation. For more details, see CWE-415.
Impact Analysis
This vulnerability enables local privilege escalation from an unprivileged user account to full root access on affected Linux systems. The CVSS base score reflects that while local access is required, no user interaction is needed and the attack complexity is relatively low. An attacker who gains initial access to a system through any means can exploit this flaw to obtain complete control, compromising the confidentiality, integrity, and availability of the entire system. For organizations running vulnerable kernel versions, this represents a critical risk as any compromised user account can become a full system compromise.
Exploit Maturity
CVE-2021-22600 has been confirmed as actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities catalog on April 11, 2022. Proof-of-concept exploits targeting the double-free in packet_set_ring() have been publicly documented. Despite a relatively low EPSS score of 0.3% (70th percentile), the confirmed exploitation in the wild and the fundamental nature of the vulnerability make it a high-priority remediation target.
Remediation
- Apply the kernel patch that fixes the double-free in packet_set_ring() as specified in CISA's KEV required action. Update to the latest stable Linux kernel version for your distribution.
- Restrict access to packet sockets by ensuring the CAP_NET_RAW capability is only granted to trusted processes and users.
- Implement kernel live patching solutions where available to minimize downtime during the update process.
- Monitor systems for signs of privilege escalation attempts, including unexpected processes running as root or unusual kernel log messages.
- Consider deploying kernel hardening measures such as KASLR, SMEP, and SMAP to make exploitation of kernel vulnerabilities more difficult.
Technical Details
The vulnerability resides in the packet_set_ring() function within the Linux kernel's AF_PACKET socket implementation. When configuring a ring buffer for packet capture, the function can be tricked into freeing a memory region twice under specific race conditions. This double-free corrupts the kernel's SLUB allocator metadata, which an attacker can leverage through heap spraying techniques to overwrite critical kernel data structures. By carefully controlling the freed memory's contents between the two free operations, an attacker can achieve arbitrary kernel code execution and escalate privileges to root.
Frequently Asked Questions
What is CVE-2021-22600?
CVE-2021-22600 is a double-free vulnerability in the Linux kernel's packet_set_ring() function that allows local attackers to escalate privileges to root. It affects the AF_PACKET socket implementation used for raw packet capture.
How can I check if my system is vulnerable?
Check your Linux kernel version using uname -r and compare it against the patched versions released by your distribution. Major distributions including Ubuntu, Debian, Red Hat, and SUSE have released advisories with specific version information.
Is remote exploitation possible?
No, this vulnerability requires local access to the system. An attacker needs the ability to create AF_PACKET sockets, which typically requires the CAP_NET_RAW capability. However, in containerized environments, this capability may be granted more broadly.
Has CVE-2021-22600 been used in real attacks?
Yes, CISA confirmed active exploitation by adding it to their Known Exploited Vulnerabilities catalog in April 2022. The vulnerability has been used as a post-compromise privilege escalation technique.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.