CVE-2021-3609

Published: Mar 3, 2022Modified: Jun 17, 2026

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: NVD

Description

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

Affected (57)

Products: Linux: Linux Kernel · Redhat: 3scale Api Management, Build Of Quarkus, Codeready Linux Builder Eus, Codeready Linux Builder For Power Little Endian Eus, Enterprise Linux Aus, Enterprise Linux Eus, Enterprise Linux For Ibm Z Systems Eus, Enterprise Linux For Ibm Z Systems Eus S390x, Enterprise Linux For Power Little Endian Eus, Enterprise Linux For Real Time, Enterprise Linux For Real Time For Nfv, Enterprise Linux For Real Time For Nfv Tus, Enterprise Linux For Real Time Tus, Enterprise Linux Server Aus, Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions, Enterprise Linux Server Tus, Enterprise Linux Server Update Services For Sap Solutions, Openshift Container Platform, Virtualization, Virtualization Host · Netapp: H300s Firmware, H500s Firmware, H700s Firmware, H300e Firmware, H500e Firmware, H700e Firmware, H410s Firmware, H410c Firmware, H610c Firmware, H610s Firmware, H615c Firmware

Linux

1 product

Linux Kernel

Redhat

20 products

3scale Api Management

Build Of Quarkus

Codeready Linux Builder Eus

Codeready Linux Builder For Power Little Endian Eus

Enterprise Linux Aus

Enterprise Linux Eus

Enterprise Linux For Ibm Z Systems Eus

Enterprise Linux For Ibm Z Systems Eus S390x

Enterprise Linux For Power Little Endian Eus

Enterprise Linux For Real Time

Enterprise Linux For Real Time For Nfv

Enterprise Linux For Real Time For Nfv Tus

Enterprise Linux For Real Time Tus

Enterprise Linux Server Aus

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions

Enterprise Linux Server Tus

Enterprise Linux Server Update Services For Sap Solutions

Openshift Container Platform

11 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 2.6.25 to 4.4.276
Linux Linux Kernel	From 4.10 to 4.14.240
Linux Linux Kernel	From 4.15 to 4.19.198
Linux Linux Kernel	From 4.20 to 5.4.132
Linux Linux Kernel	From 4.5 to 4.9.276
Linux Linux Kernel	From 5.11 to 5.12.17
Linux Linux Kernel	From 5.13 to 5.13.2
Linux Linux Kernel	From 5.5.0 to 5.10.50

Configuration B

38 vulnerable

Vulnerable Software	Affected Versions
Redhat 3scale Api Management	Version 2.0
Redhat Build Of Quarkus	Version 1.0
Redhat Codeready Linux Builder Eus	Version 8.1
Redhat Codeready Linux Builder Eus	Version 8.2
Redhat Codeready Linux Builder Eus	Version 8.4
Redhat Codeready Linux Builder For Power Little Endian Eus	Version 8.1
Redhat Codeready Linux Builder For Power Little Endian Eus	Version 8.2
Redhat Codeready Linux Builder For Power Little Endian Eus	Version 8.4
Redhat Enterprise Linux Aus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Eus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 8.4
Redhat Enterprise Linux For Ibm Z Systems Eus S390x	Version 8.1
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.1
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.2
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.4
Redhat Enterprise Linux For Real Time	Version 8.0
Redhat Enterprise Linux For Real Time For Nfv	Version 8.0
Redhat Enterprise Linux For Real Time For Nfv Tus	Version 8.0
Redhat Enterprise Linux For Real Time For Nfv Tus	Version 8.2
Redhat Enterprise Linux For Real Time Tus	Version 8.0
Redhat Enterprise Linux For Real Time Tus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions	Version 8.1
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions	Version 8.2
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions	Version 8.4
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.4
Redhat Enterprise Linux Server Update Services For Sap Solutions	Version 8.1
Redhat Enterprise Linux Server Update Services For Sap Solutions	Version 8.2
Redhat Enterprise Linux Server Update Services For Sap Solutions	Version 8.4
Redhat Openshift Container Platform	Version 4.6
Redhat Openshift Container Platform	Version 4.7
Redhat Openshift Container Platform	Version 4.8
Redhat Virtualization	Version 4.0
Redhat Virtualization Host	Version 4.0

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610c Firmware	All versions

Running on/with	Platform Versions
Netapp H610c	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610s Firmware	All versions

Running on/with	Platform Versions
Netapp H610s	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H615c Firmware	All versions

Running on/with	Platform Versions
Netapp H615c	All versions

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (10)

https://bugzilla.redhat.com/show_bug.cgi?id=1971651

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md

Source: secalert@redhat.com

ExploitTechnical DescriptionThird Party Advisory

https://github.com/torvalds/linux/commit/d5f9023fa61ee8b94f37a93f08e94b136cf1e463

Source: secalert@redhat.com

PatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20220419-0004/

Source: secalert@redhat.com

Third Party Advisory

https://www.openwall.com/lists/oss-security/2021/06/19/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1971651