CVE-2021-25682

What it actually does

Improper parsing of /proc/pid/status contents in get_pid_info allows malformed kernel data to be accepted, resulting in local privilege escalation to full system compromise.

Why it matters to the business

Attackers with local access can take complete control of mail servers, leading to data theft, service disruption, and potential regulatory penalties; high prevalence in Debian and Git deployments increases exposure across many organizations.

How an attack unfolds

An authenticated local user crafts malicious content in /proc/pid/status that bypasses the faulty parser, causing the application to mishandle process data and execute attacker-controlled code with elevated privileges.

How to fix it

Upgrade exim4 on Debian 11/12/13 to 4.94.2-1 or later and exim Git to commit 919111edac911ba9c15422eafd7c5bf14d416d26; verify the update and restart the service.

How to confirm the fix worked

Confirm package versions match the fixed releases, run regression tests on process status parsing, and monitor for any remaining instances of the vulnerable parser code.

Typical attack path

1. Obtain local shell access on a system running the vulnerable mail server
2. Prepare malformed process status data targeting the parser flaw
3. Trigger the get_pid_info call via local process interaction
4. Escalate privileges to root and establish persistence or exfiltrate data

How to detect it

Review local process creation logs, authentication events, and any application crash reports around the time of suspected activity; look for unexpected privilege changes or unusual process status file accesses.

What your security team should do

• Apply the listed fixed versions immediately due to public exploit availability
• Audit local user access controls on all affected mail servers
• Enable enhanced logging for process-related operations
• Schedule vulnerability scans to confirm absence of older versions