CVE-2021-43057
📋 TL;DR
A use-after-free vulnerability in the SELinux PTRACE_TRACEME handler in Linux kernel versions before 5.14.8 allows local attackers to cause memory corruption and potentially escalate privileges. This affects systems running vulnerable Linux kernels with SELinux enabled. Attackers must have local access to exploit this vulnerability.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, allowing complete system compromise and persistence.
Likely Case
Local privilege escalation to gain higher privileges than the attacker's current user account.
If Mitigated
No impact if SELinux is disabled or kernel is patched; minimal impact with proper access controls limiting local user accounts.
🎯 Exploit Status
Exploit requires local access and knowledge of kernel exploitation techniques; Project Zero published technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.14.8 and later
Vendor Advisory: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.8
Restart Required: Yes
Instructions:
1. Update kernel to version 5.14.8 or later using your distribution's package manager. 2. For Red Hat/CentOS: yum update kernel. 3. For Ubuntu/Debian: apt update && apt upgrade linux-image. 4. Reboot the system to load the new kernel.
🔧 Temporary Workarounds
Disable SELinux
linuxTemporarily disable SELinux to prevent exploitation (not recommended for production)
setenforce 0
echo 0 > /sys/fs/selinux/enforce
Restrict ptrace access
linuxLimit ptrace capabilities using kernel.yama.ptrace_scope
sysctl -w kernel.yama.ptrace_scope=2
echo 'kernel.yama.ptrace_scope=2' >> /etc/sysctl.conf
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts and shell access
- Monitor for privilege escalation attempts and unusual ptrace activity
🔍 How to Verify
Check if Vulnerable:
Check kernel version and SELinux status: uname -r && getenforceCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.14.8 or later: uname -r📡 Detection & Monitoring
Log Indicators:
- Failed privilege escalation attempts
- Unusual ptrace system calls
- SELinux denial logs related to ptrace
Network Indicators:
- None - local exploit only
SIEM Query:
process.name:ptrace AND event.action:denied OR process.name:su AND event.outcome:failure🔗 References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2229
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.8
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a3727a8bac0a9e77c70820655fd8715523ba3db7
- https://security.netapp.com/advisory/ntap-20211125-0001/
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2229
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.8
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a3727a8bac0a9e77c70820655fd8715523ba3db7
- https://security.netapp.com/advisory/ntap-20211125-0001/
