CVE-2021-23133

What it actually does

Race condition in Linux kernel SCTP socket destruction (net/sctp/socket.c) allows removal of an element from auto_asconf_splist without holding sock_net(sk)->sctp.addr_wq_lock, enabling local privilege escalation to root from network service context or unprivileged processes with specific BPF_CGROUP_INET_SOCK_CREATE attachments.

Why it matters to the business

Successful exploitation grants full system control to attackers on unpatched Linux systems, risking data theft, service disruption, and lateral movement across server fleets; though publicly known for years with available exploits, the flaw remains relevant for any remaining outdated kernels handling SCTP.

How an attack unfolds

An attacker with local network service access or an attached BPF program triggers concurrent SCTP socket creation and destruction paths; the missing lock during sctp_destroy_sock permits list manipulation that corrupts kernel structures, ultimately allowing code execution as root. No named threat actors have been linked to widespread campaigns against this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b or later; disable SCTP where unnecessary and apply vendor-supplied updates across all affected distributions.

How to confirm the fix worked

Verify the running kernel includes the referenced commit or is newer than the vulnerable range; recompile with the fix and confirm SCTP socket lifecycle no longer triggers the race under load testing.

Typical attack path

1. Obtain local access or network service privileges on a vulnerable Linux system
2. Trigger SCTP socket operations while a race window exists in socket teardown
3. Exploit unlocked list removal in auto_asconf_splist to corrupt kernel memory
4. Escalate privileges to root and execute arbitrary code

How to detect it

Review kernel audit logs and system call traces for unusual SCTP socket creation/destruction sequences coinciding with privilege changes; examine dmesg or auditd records for list corruption warnings or unexpected root escalations involving network processes.

• sctp_destroy_sock
• auto_asconf_splist

What your security team should do

• Prioritize kernel upgrades on all systems exposing SCTP or running network services
• Audit for legacy kernels still in use and schedule immediate replacement
• Restrict SCTP usage via firewall rules or module blacklisting until patched
• Monitor kernel update channels for any backported fixes in supported LTS releases