Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2021-4154

Disclosure Date: February 04, 2022
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Initial Access
Techniques
Validation
Validated

Description

A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel’s cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
8.8 High
Impact Score:
6
Exploitability Score:
2
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Changed
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • linux,
  • netapp,
  • redhat

Products

  • enterprise linux 8.0,
  • hci baseboard management controller h300e,
  • hci baseboard management controller h300s,
  • hci baseboard management controller h410s,
  • hci baseboard management controller h500e,
  • hci baseboard management controller h500s,
  • hci baseboard management controller h700e,
  • hci baseboard management controller h700s,
  • linux kernel,
  • linux kernel 5.14,
  • virtualization 4.0
Technical Analysis