CVE-2021-4037

Aliases:UBUNTU-CVE-2021-4037DEBIAN-CVE-2021-4037

Advisory lineage Upstream: 0 Downstream: 25

Downstream

DEBIAN-CVE-2021-4037 DLA-3173-1 DSA-5257-1 RHSA-2022:1975 RHSA-2022:1988 RHSA-2022:4829

Modified

Published: 24 Aug 2022, 00:00

Last modified:10 Aug 2026, 16:47

Vulnerability Summary

Overall Risk (default)

low

18/100

CVSS Score

4.4 MEDIUM

v3.1 (nvd)

EPSS Score

0.31% LOW

0% probability +0.28%

KEV

Not listed

Ransomware

No reports

Public exploits

None found

Dark Web

Not detected

Timeline

24 Aug 2022, 00:00

Published

Vulnerability first disclosed

10 Aug 2026, 16:47

Last Modified

Vulnerability information updated

Description

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.

CVSS Metrics

v4.0•LOW•Score: 2CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
v3.1•MEDIUM•Score: 4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.31%• Percentile: 25%

Techniques & Countermeasures

CWE-284•Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected Systems

debian•linux
< 5.10.149-1 | < 5.14.6-1 | < 5.14.6-1 | < 5.14.6-1
ubuntu•linux
all | < 4.4.0-234.268 | < 4.15.0-166.174 | < 5.4.0-92.103
ubuntu•linux-aws
< 4.4.0-1113.119 | < 4.4.0-1151.166 | < 4.15.0-1118.125 | < 5.4.0-1061.64
ubuntu•linux-aws-5.0
all
ubuntu•linux-aws-5.11
< 5.11.0-1023.24~20.04.1
ubuntu•linux-aws-5.3
all
ubuntu•linux-aws-5.4
< 5.4.0-1061.64~18.04.1
ubuntu•linux-aws-5.8
all
ubuntu•linux-aws-fips
< 4.15.0-2059.61 | all | < 5.4.0-1069.73+fips2
ubuntu•linux-aws-hwe
< 4.15.0-1118.125~16.04.1
ubuntu•linux-azure
< 4.15.0-1129.142~14.04.1 | < 4.15.0-1129.142~16.04.1 | all | < 5.4.0-1065.68
ubuntu•linux-azure-4.15
< 4.15.0-1129.142
ubuntu•linux-azure-5.11
< 5.11.0-1023.24~20.04.1
ubuntu•linux-azure-5.3
all
ubuntu•linux-azure-5.4
< 5.4.0-1065.68~18.04.1
ubuntu•linux-azure-5.8
all
ubuntu•linux-azure-edge
all
ubuntu•linux-azure-fde-5.15
< 5.15.0-1114.123~20.04.1
ubuntu•linux-azure-fips
< 4.15.0-2041.45 | all | < 5.4.0-1073.76+fips1
ubuntu•linux-bluefield
all | < 5.4.0-1023.26
ubuntu•linux-dell300x
< 4.15.0-1033.38
ubuntu•linux-fips
< 4.4.0-1083.90 | all | < 4.15.0-1075.84 | < 5.4.0-1038.44
ubuntu•linux-gcp
< 4.15.0-1114.128~16.04.1 | all | < 5.4.0-1059.63
ubuntu•linux-gcp-4.15
< 4.15.0-1114.128
ubuntu•linux-gcp-5.11
< 5.11.0-1024.26~20.04.1
ubuntu•linux-gcp-5.3
all
ubuntu•linux-gcp-5.4
< 5.4.0-1059.63~18.04.1
ubuntu•linux-gcp-5.8
all
ubuntu•linux-gcp-fips
< 4.15.0-2024.26 | all | < 5.4.0-1067.71~20.04.1
ubuntu•linux-gke
< 5.4.0-1057.60
ubuntu•linux-gke-4.15
all
ubuntu•linux-gke-5.4
< 5.4.0-1057.60~18.04.1
ubuntu•linux-gkeop
< 5.4.0-1029.30
ubuntu•linux-gkeop-5.4
< 5.4.0-1029.30~18.04.2
ubuntu•linux-hwe
< 4.15.0-166.174~16.04.1 | all
ubuntu•linux-hwe-5.11
all
ubuntu•linux-hwe-5.4
< 5.4.0-92.103~18.04.2
ubuntu•linux-hwe-5.8
all
ubuntu•linux-hwe-edge
all | all
ubuntu•linux-ibm
< 5.4.0-1010.11
ubuntu•linux-intel-5.13
all
ubuntu•linux-intel-iot-realtime
all
ubuntu•linux-kvm
< 4.4.0-1114.124 | < 4.15.0-1105.107 | < 5.4.0-1051.53
ubuntu•linux-lts-xenial
< 4.4.0-234.268~14.04.1
ubuntu•linux-oem
all
ubuntu•linux-oem-5.10
< 5.10.0-1052.54
ubuntu•linux-oem-5.6
all
ubuntu•linux-oracle
< 4.15.0-1085.93~16.04.1 | < 4.15.0-1085.93 | < 5.4.0-1059.63
ubuntu•linux-oracle-5.0
all
ubuntu•linux-oracle-5.11
< 5.11.0-1023.24~20.04.1

Showing first 50 affected entries in server-rendered view.