CVE-2021-20321

What it actually does

Race condition in OverlayFS file object access during specific rename operations allows a local process to trigger a kernel crash, resulting in denial of service.

Why it matters to the business

Local users on affected Linux systems can intentionally or accidentally cause full system crashes, leading to unplanned downtime, loss of availability for services, and potential data loss in memory for long-running workloads; the issue has been public for over four years with no signs of widespread exploitation.

How an attack unfolds

An attacker with local access on a system using OverlayFS crafts a sequence of file rename operations that triggers the race condition in the kernel's file object handling, causing the system to panic and reboot or halt.

How to fix it

Upgrade the Linux kernel to a version containing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 or later; apply vendor-supplied kernel updates that backport the fix; disable OverlayFS if not required for the workload.

How to confirm the fix worked

Confirm the running kernel contains commit 8bb7eca972ad531c9b149c0a51ab43a417385813 or an equivalent backport; attempt to reproduce the rename race condition in a test environment and verify no crash occurs; review kernel changelog for OverlayFS race condition fixes after February 2022.

Typical attack path

1. Obtain local shell or process execution on target Linux system
2. Mount or access an OverlayFS filesystem
3. Perform repeated or specially timed rename operations on files within the overlay
4. Trigger kernel panic via the race condition
5. Observe system crash and denial of service

How to detect it

Search kernel logs for oops, panic, or BUG messages referencing overlayfs or file object races; look for processes performing rapid or unusual rename activity on overlay mounts prior to crashes; correlate local user activity with system reboots without external cause.

What your security team should do

• Prioritize kernel upgrades on all systems using OverlayFS, especially multi-user or container hosts
• Audit workloads for OverlayFS usage and restrict local unprivileged access where possible
• Monitor for kernel oops/panic logs related to overlayfs
• Apply the fix even on systems with low EPSS scores due to the age of the public disclosure