CVE-2021-35039
📋 TL;DR
This vulnerability in the Linux kernel allows loading of unsigned kernel modules even when module signature enforcement is requested via the module.sig_enforce=1 command-line argument. Systems running Linux kernel versions before 5.12.14 without CONFIG_MODULE_SIG enabled are affected, potentially allowing attackers to load malicious kernel modules.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Attackers could load malicious kernel modules to gain root privileges, establish persistence, bypass security controls, or cause system instability/crashes.
Likely Case
Privileged attackers could load malicious kernel modules to escalate privileges or bypass security mechanisms.
If Mitigated
With proper controls, impact is limited to systems where attackers already have sufficient privileges to load modules.
🎯 Exploit Status
Requires ability to load kernel modules (typically root or CAP_SYS_MODULE capability).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.12.14 and later
Vendor Advisory: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.14
Restart Required: Yes
Instructions:
1. Update kernel to version 5.12.14 or later. 2. Rebuild kernel if using custom kernel. 3. Reboot system to load patched kernel.
🔧 Temporary Workarounds
Enable CONFIG_MODULE_SIG
linuxBuild kernel with CONFIG_MODULE_SIG enabled to enforce module signature verification
Ensure CONFIG_MODULE_SIG=y in kernel configuration before building
Disable module loading
linuxPrevent loading of kernel modules entirely
echo 1 > /proc/sys/kernel/modules_disabled
🧯 If You Can't Patch
- Ensure CONFIG_MODULE_SIG is enabled in kernel configuration
- Restrict module loading to trusted users only via capabilities or SELinux/AppArmor policies
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if CONFIG_MODULE_SIG is enabled: uname -r and grep CONFIG_MODULE_SIG /boot/config-$(uname -r)Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.12.14 or later: uname -r📡 Detection & Monitoring
Log Indicators:
- Kernel module loading attempts in system logs
- Failed module signature verification messages
Network Indicators:
- None - local exploitation only
SIEM Query:
source="kernel" AND "module" AND ("loading" OR "signature")🔗 References
- http://www.openwall.com/lists/oss-security/2021/07/06/3
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.14
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0c18f29aae7ce3dadd26d8ee3505d07cc982df75
- https://github.com/torvalds/linux/commit/0c18f29aae7ce3dadd26d8ee3505d07cc982df75
- https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
- https://security.netapp.com/advisory/ntap-20210813-0004/
- https://www.openwall.com/lists/oss-security/2021/07/06/3
- http://www.openwall.com/lists/oss-security/2021/07/06/3
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.14
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0c18f29aae7ce3dadd26d8ee3505d07cc982df75
- https://github.com/torvalds/linux/commit/0c18f29aae7ce3dadd26d8ee3505d07cc982df75
- https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
- https://security.netapp.com/advisory/ntap-20210813-0004/
- https://www.openwall.com/lists/oss-security/2021/07/06/3
