Executive brief
A vulnerability in the Linux Kernel's networking subsystem allows a local user to gain full administrative control over a system. By exploiting a memory error in the firewall component, an attacker can bypass security restrictions and potentially crash the system or steal sensitive data. This issue is particularly significant because it has been observed being used in active attacks.
Technical details
A heap out-of-bounds write vulnerability exists in net/netfilter/x_tables.c in the Linux Kernel. The flaw is triggered when handling certain setsockopt calls, where an integer underflow or incorrect size calculation leads to memory corruption. An attacker with local access and the ability to create user namespaces can exploit this to overwrite kernel memory, leading to local privilege escalation (LPE) to root or a system crash (DoS). The vulnerability has been present since version 2.6.19-rc1 and is confirmed to be exploited in the wild. Patches are available in the upstream kernel.
Affected products
- Linux Linux Kernel v2.6.19-rc1 and later
Timeline
- 2021-04-20: disclosed: Initial discovery and disclosure by Google security researchers.
- 2025-10-06: kev added: Added to CISA Known Exploited Vulnerabilities catalog.