CVE-2021-4197

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-4197
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2035652 Issue Tracking Third Party Advisory
https://lore.kernel.org/lkml/20211209214707.805617-1-tj%40kernel.org/T/
https://security.netapp.com/advisory/ntap-20220602-0006/ Third Party Advisory
https://www.debian.org/security/2022/dsa-5127 Third Party Advisory
https://www.debian.org/security/2022/dsa-5173 Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.2.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
History

16 May 2023, 10:59

Type Values Removed Values Added
References (DEBIAN) https://www.debian.org/security/2022/dsa-5127 - (DEBIAN) https://www.debian.org/security/2022/dsa-5127 - Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220602-0006/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220602-0006/ - Third Party Advisory
References (DEBIAN) https://www.debian.org/security/2022/dsa-5173 - (DEBIAN) https://www.debian.org/security/2022/dsa-5173 - Third Party Advisory
References (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Third Party Advisory
CPE cpe:2.3:a:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.1:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.2.0:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

25 Jul 2022, 18:18

Type Values Removed Values Added
References
  • (N/A) https://www.oracle.com/security-alerts/cpujul2022.html -

04 Jul 2022, 11:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2022/dsa-5173 -

02 Jun 2022, 20:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220602-0006/ -

03 May 2022, 11:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2022/dsa-5127 -

30 Mar 2022, 20:10

Type Values Removed Values Added
CPE cpe:2.3:a:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-287
CVSS v2 : unknown
v3 : unknown 		v2 : 7.2
v3 : 7.8
References (MISC) https://lore.kernel.org/lkml/20211209214707.805617-1-tj@kernel.org/T/ - (MISC) https://lore.kernel.org/lkml/20211209214707.805617-1-tj@kernel.org/T/ - Exploit, Mailing List, Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2035652 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2035652 - Issue Tracking, Third Party Advisory

23 Mar 2022, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-03-23 20:15

Updated : 2024-02-04 22:29

NVD link : CVE-2021-4197

Mitre link : CVE-2021-4197

CVE.ORG link : CVE-2021-4197

JSON object : View

Products Affected

oracle

  • communications_cloud_native_core_binding_support_function

netapp

  • h410s
  • h700s_firmware
  • h500s_firmware
  • h410c_firmware
  • h300s
  • h300s_firmware
  • h700s
  • h500s
  • h410c
  • h410s_firmware

broadcom

  • brocade_fabric_operating_system_firmware

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-287

Improper Authentication