Vulnerability in Linux Kernel
CVE-2021-3609
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (37.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
- ARPSyndicate/cvemon
- kdn111/linux-kernel-exploitation
- khanhdn111/linux-kernel-exploitation
- khanhdz-06/linux-kernel-exploitation
- khanhdz191/linux-kernel-exploitation
- khanhhdz/linux-kernel-exploitation
- khanhhdz06/linux-kernel-exploitation
- khanhnd123/linux-kernel-exploitation
- khnhdz/linux-kernel-exploitation
- knd06/linux-kernel-exploitation
References
- bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
- www.openwall.com/lists/oss-security/2021/06/19/1 (Mailing List, Third Party Advisory)
- github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md (Technical Description, Exploit, Third Party Advisory)
- github.com/torvalds/linux/commit/d5f9023fa61ee8b94f37a93f08e94b136cf1e463 (Patch, Third Party Advisory)
- security.netapp.com/advisory/ntap-20220419-0004/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-3609?
- CVE-2021-3609 is a high-severity vulnerability in Linux Kernel, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.0/10. Published 2022-03-03.
- How severe is CVE-2021-3609?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2021-3609 known to be exploited?
- 15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.