CVE-2021-23133: Linux Kernel sctp_destroy_sock race condition
Vulnerability summary
CVE-2021-23133 is a high (CVSS 7.0) vulnerability in broadcom brocade_fabric_operating_system_firmware. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 41% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.7, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 29 · Related 21Timeline
- 22-04-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.47% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu53 products
- linux< 4.15.0-147.151 | < 5.4.0-77.86
- linux-aws< 4.15.0-1106.113 | < 5.4.0-1051.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1051.53~18.04.1
Suse6 products
- kernel-livepatch-SLE15-SP2_Update_11&distro=SUSE Linux Enterprise Live Patching 15 SP2< 6-2.2
- kernel-livepatch-SLE15-SP2_Update_12&distro=SUSE Linux Enterprise Live Patching 15 SP2< 3-2.1
- kernel-livepatch-SLE15-SP2_Update_13&distro=SUSE Linux Enterprise Live Patching 15 SP2< 3-2.1
- kernel-livepatch-SLE15-SP3_Update_0&distro=SUSE Linux Enterprise Live Patching 15 SP3< 3-3.1
- kgraft-patch-SLE12-SP5_Update_17&distro=SUSE Linux Enterprise Live Patching 12 SP5< 4-2.2
Debian2 products
- linux< 5.10.38-1
- debian_linuxEOL9.0
Broadcom1 product
Fedoraproject1 product
- fedoraEOL32 | 33 | 34
Linux1 product
- linux_kernel< 4.4.269 | ≥ 4.5, < 4.9.269 | ≥ 4.10, < 4.14.233 | ≥ 4.15, < 4.19.191 | ≥ 4.20, < 5.4.119 | ≥ 5.5, < 5.10.37 | ≥ 5.11, < 5.11.21 | ≥ 5.12, < 5.12.4
Linux kernel1 product
- linux kernel≥ unspecified, < 5.12-rc8
8 vendors · 76 products
References
29 links- www.openwall.com/lists/oss-security/2021/04/18/2X Refsource MISCREPORTExploitMailing ListPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2021/05/10/1Mailing ListX Refsource MLISTPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2021/05/10/2Mailing ListX Refsource MLISTPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2021/05/10/4Mailing ListX Refsource MLISTPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2021/05/10/3Mailing ListX Refsource MLISTPatchThird Party Advisory
Show all 29 references
lists.debian.org/debian-lts-announce/2021/06/msg00020.htmlMailing ListX Refsource MLISTMitigationThird Party Advisory- lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlMailing ListX Refsource MLISTMitigationThird Party Advisory
- git.kernel.org/pub/…REPORT
