CVE-2021-3759

What it actually does

A local user can repeatedly invoke semget to create semaphores within the memcg subsystem, exhausting kernel memory resources and triggering a denial of service.

Why it matters to the business

Systems become unavailable, halting workloads and requiring administrative intervention or reboot to restore service.

How an attack unfolds

An attacker with local access on an affected Linux kernel repeatedly calls the semget function to allocate semaphores, starving the memcg subsystem until the system is rendered unresponsive.

How to fix it

Upgrade the Linux kernel to a patched release that addresses the memcg semaphore handling flaw; apply vendor updates for Debian and other distributions as they become available.

How to confirm the fix worked

Verify the installed kernel version against upstream fixes, test that repeated semget calls no longer cause resource exhaustion, and confirm system stability under load.

Typical attack path

1. Gain local shell access on the target system
2. Execute repeated semget calls in a loop or script
3. Monitor resource consumption until the kernel starves and availability is lost

How to detect it

Review system logs for repeated IPC or semaphore allocation events, high memory pressure in the memcg subsystem, and sudden unresponsiveness coinciding with local user activity.

What your security team should do

• Prioritize kernel updates across all Linux hosts
• Restrict local user access where possible to reduce attack surface
• Monitor for unusual semaphore or IPC activity in production environments