CVE-2021-3609
📋 TL;DR
CVE-2021-3609 is a race condition vulnerability in the Linux kernel's CAN BCM networking protocol that allows local attackers to corrupt memory and potentially escalate privileges to root. This affects Linux systems with CAN bus support enabled, primarily impacting embedded systems, automotive systems, and industrial control systems using CAN networking.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Codeready Linux Builder For Power Little Endian Eus by Redhat
View all CVEs affecting Codeready Linux Builder For Power Little Endian Eus →
Codeready Linux Builder For Power Little Endian Eus by Redhat
View all CVEs affecting Codeready Linux Builder For Power Little Endian Eus →
Codeready Linux Builder For Power Little Endian Eus by Redhat
View all CVEs affecting Codeready Linux Builder For Power Little Endian Eus →
Enterprise Linux For Ibm Z Systems Eus by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems Eus →
Enterprise Linux For Ibm Z Systems Eus S390x by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems Eus S390x →
Enterprise Linux For Power Little Endian Eus by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian Eus →
Enterprise Linux For Power Little Endian Eus by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian Eus →
Enterprise Linux For Power Little Endian Eus by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian Eus →
Enterprise Linux For Real Time For Nfv by Redhat
View all CVEs affecting Enterprise Linux For Real Time For Nfv →
Enterprise Linux For Real Time For Nfv Tus by Redhat
View all CVEs affecting Enterprise Linux For Real Time For Nfv Tus →
Enterprise Linux For Real Time For Nfv Tus by Redhat
View all CVEs affecting Enterprise Linux For Real Time For Nfv Tus →
Enterprise Linux For Real Time Tus by Redhat
View all CVEs affecting Enterprise Linux For Real Time Tus →
Enterprise Linux For Real Time Tus by Redhat
View all CVEs affecting Enterprise Linux For Real Time Tus →
Enterprise Linux Server Update Services For Sap Solutions by Redhat
View all CVEs affecting Enterprise Linux Server Update Services For Sap Solutions →
Enterprise Linux Server Update Services For Sap Solutions by Redhat
View all CVEs affecting Enterprise Linux Server Update Services For Sap Solutions →
Enterprise Linux Server Update Services For Sap Solutions by Redhat
View all CVEs affecting Enterprise Linux Server Update Services For Sap Solutions →
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Full root privilege escalation leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation allowing attackers to gain root access on vulnerable systems, potentially leading to lateral movement within networks.
If Mitigated
Limited impact if systems have proper access controls, minimal local user accounts, and CAN networking disabled where not needed.
🎯 Exploit Status
Exploitation requires local access and knowledge of race condition timing. Public proof-of-concept code exists on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.13-rc1 and later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1971651
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.13-rc1 or later. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system after update.
🔧 Temporary Workarounds
Disable CAN subsystem
linuxRemove CAN kernel modules to prevent exploitation
sudo modprobe -r can_raw
sudo modprobe -r can
sudo modprobe -r can_bcm
echo 'blacklist can' | sudo tee /etc/modprobe.d/blacklist-can.conf
Restrict CAN socket access
linuxUse Linux capabilities to restrict who can create CAN sockets
sudo setcap -r /bin/ip
sudo setcap cap_net_raw-ep /bin/ip
🧯 If You Can't Patch
- Disable CAN subsystem modules if not required for system functionality
- Implement strict access controls and limit local user accounts on affected systems
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r and compare to affected versions. Check if CAN modules are loaded: lsmod | grep -i canCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.13-rc1 or later: uname -r. Check that CAN modules are either updated or disabled.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages related to CAN or memory corruption
- Unexpected privilege escalation events in audit logs
- Failed CAN socket creation attempts from non-privileged users
Network Indicators:
- CAN bus traffic anomalies if monitoring industrial networks
SIEM Query:
source="kernel" AND ("CAN" OR "bcm" OR "race condition") OR event_type="privilege_escalation" AND process_name="exploit"🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1971651
- https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md
- https://github.com/torvalds/linux/commit/d5f9023fa61ee8b94f37a93f08e94b136cf1e463
- https://security.netapp.com/advisory/ntap-20220419-0004/
- https://www.openwall.com/lists/oss-security/2021/06/19/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1971651
- https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md
- https://github.com/torvalds/linux/commit/d5f9023fa61ee8b94f37a93f08e94b136cf1e463
- https://security.netapp.com/advisory/ntap-20220419-0004/
- https://www.openwall.com/lists/oss-security/2021/06/19/1
