CVE-2021-27364
📋 TL;DR
CVE-2021-27364 is a Linux kernel vulnerability in the iSCSI subsystem that allows unprivileged local users to cause a denial of service or potentially escalate privileges by sending specially crafted Netlink messages. It affects Linux systems with kernel versions up to 5.11.3. The vulnerability requires local access to the system.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Solidfire Baseboard Management Controller Firmware by Netapp
View all CVEs affecting Solidfire Baseboard Management Controller Firmware →
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, complete system compromise, or kernel panic causing system crash.
Likely Case
Denial of service through kernel panic or system instability.
If Mitigated
Limited impact if proper access controls prevent unprivileged users from accessing the system.
🎯 Exploit Status
Exploit requires local access and knowledge of Netlink message crafting. Proof-of-concept code has been published.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.11.4 and later
Vendor Advisory: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.11.4 or later. 2. Apply vendor-specific patches for older kernels. 3. Reboot system to load patched kernel.
🔧 Temporary Workarounds
Restrict Netlink access
linuxUse kernel capabilities or SELinux/AppArmor to restrict unprivileged users from accessing Netlink sockets
echo 'kernel.dmesg_restrict = 1' >> /etc/sysctl.conf
sysctl -p
Disable iSCSI module
linuxRemove or blacklist the iSCSI kernel module if not needed
echo 'blacklist scsi_transport_iscsi' >> /etc/modprobe.d/blacklist.conf
rmmod scsi_transport_iscsi
🧯 If You Can't Patch
- Implement strict access controls to prevent unprivileged users from accessing the system
- Use kernel live patching solutions if available for your distribution
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is 5.11.3 or earlier, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
After patching, verify kernel version is 5.11.4 or later with uname -r📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/kern.log or dmesg
- Unexpected iSCSI-related errors
Network Indicators:
- None - this is a local exploit
SIEM Query:
source="kern.log" AND "kernel panic" OR "Oops" AND "iscsi"🔗 References
- http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
- https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html
- https://bugzilla.suse.com/show_bug.cgi?id=1182717
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
- https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
- https://security.netapp.com/advisory/ntap-20210409-0001/
- https://www.openwall.com/lists/oss-security/2021/03/06/1
- https://www.oracle.com/security-alerts/cpuoct2021.html
- http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
- https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html
- https://bugzilla.suse.com/show_bug.cgi?id=1182717
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
- https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
- https://security.netapp.com/advisory/ntap-20210409-0001/
- https://www.openwall.com/lists/oss-security/2021/03/06/1
- https://www.oracle.com/security-alerts/cpuoct2021.html
