CVE-2021-23134

What it actually does

Use-after-free condition in NFC socket handling within the Linux kernel allows a local process holding CAP_NET_RAW to trigger memory corruption and achieve arbitrary code execution with elevated privileges.

Why it matters to the business

A local attacker with limited network privileges can obtain full root access on affected systems, leading to complete host compromise, data theft, or persistence; the vulnerability affects widely deployed Linux distributions and downstream products.

How an attack unfolds

An attacker obtains a local shell with CAP_NET_RAW, opens and manipulates NFC sockets in a sequence that frees an object while it is still referenced, then reclaims the memory to overwrite function pointers or credentials and execute code as root.

How to fix it

Upgrade the Linux kernel to version 5.12.4 or later on all affected distributions; apply vendor backports where available and rebuild any custom kernel modules that interact with NFC sockets.

How to confirm the fix worked

Verify the running kernel version is at least 5.12.4, confirm the NFC socket use-after-free fix is present in the source, and test that unprivileged or CAP_NET_RAW processes cannot trigger the original crash or escalation path.

Typical attack path

1. Gain local shell access on a target system
2. Acquire or inherit the CAP_NET_RAW capability
3. Perform crafted NFC socket operations to trigger the use-after-free
4. Leverage the resulting memory corruption for privilege escalation to root

How to detect it

Review kernel audit logs and dmesg for NFC socket related crashes or warnings around the time of suspected activity; correlate with processes that suddenly gain root privileges without sudo or setuid transitions.

What your security team should do

• Prioritize kernel upgrades on internet-facing or multi-tenant hosts within the next patching cycle
• Audit which services or containers run with CAP_NET_RAW and remove the capability where NFC is not required
• Enable kernel hardening features such as lockdown mode and restrict untrusted local users
• Monitor for future Linux kernel CVEs in the NFC subsystem and maintain a rapid kernel update process