CVE-2021-47118 – This Linux kernel vulnerability allows a local ... (How to Fix)

Q: What is the severity of CVE-2021-47118?

CVE-2021-47118 has a CVSS score of 7.8 (HIGH). This Linux kernel vulnerability allows a local attacker to trigger a use-after-free condition by modifying the cad_pid sysctl parameter, which could lead to kernel memory corruption, crashes, or potential privilege escalation. It affects Linux systems running vulnerable kernel versions where the cad_pid initialization lacks proper reference counting. The vulnerability requires local access to the system.

📋 TL;DR

This Linux kernel vulnerability allows a local attacker to trigger a use-after-free condition by modifying the cad_pid sysctl parameter, which could lead to kernel memory corruption, crashes, or potential privilege escalation. It affects Linux systems running vulnerable kernel versions where the cad_pid initialization lacks proper reference counting. The vulnerability requires local access to the system.

💻 Affected Systems

Products:

Linux Kernel

Versions: v2.6.19 through v5.13-rc3 (specifically vulnerable versions before fixes were backported)

Operating Systems: All Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires ability to write to /proc/sys/kernel/cad_pid (typically root or users with CAP_SYS_RESOURCE capability). The vulnerability has existed since v2.6.19 but was discovered in v5.13-rc3.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic, system crash, or privilege escalation to root via memory corruption leading to arbitrary code execution in kernel context.

🟠

Likely Case

Kernel crash or system instability when cad_pid sysctl is modified, potentially causing denial of service.

🟢

If Mitigated

No impact if patched or if sysctl modifications are restricted via proper access controls.

🌐 Internet-Facing: LOW - Requires local access to exploit, not directly reachable from network.

🏢 Internal Only: MEDIUM - Local users or processes with sysctl write permissions could trigger the vulnerability, potentially leading to system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to modify sysctl parameters. The vulnerability was discovered through fuzzing with Syzkaller, suggesting potential for reliable exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel versions with commits: 0711f0d7050b9e07c44bc159bbc64ac0a1022c7f, 2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dff, 4dbd8808a591b49b717862e6e0081bcf14a87788, 7178be006d495ffb741c329012da289b62dddfe6, 764c2e892d1fe895392aff62fb353fdce43bb529

Vendor Advisory: https://git.kernel.org/stable/c/0711f0d7050b9e07c44bc159bbc64ac0a1022c7f

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Restrict cad_pid sysctl access

linux

Limit write access to /proc/sys/kernel/cad_pid to prevent triggering the vulnerability

chmod 644 /proc/sys/kernel/cad_pid
sysctl -w kernel.cad_pid=1

🧯 If You Can't Patch

Restrict sysctl write permissions using capabilities or SELinux/AppArmor policies
Monitor for unauthorized attempts to modify kernel parameters

🔍 How to Verify

Check if Vulnerable:

Check kernel version: uname -r and compare against affected versions (v2.6.19 to v5.13-rc3). Also check if /proc/sys/kernel/cad_pid exists and is writable.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is newer than affected range and check that cad_pid initialization has proper reference counting in kernel source.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
KASAN use-after-free reports in dmesg
Unexpected system crashes

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("KASAN: use-after-free" OR "BUG: KASAN" OR "cad_pid")

📊 Metadata

CVE ID: CVE-2021-47118

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: March 15, 2024

Last Updated: February 27, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47118, you might also want to check these: