Cloudanix VulnDB

CVE-2021-3982

Medium · 5.5

CVSS

5.5

EPSS

0.3%

Published

Apr 29, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A local user on certain Linux machines can interfere with other programs running at the same time, potentially slowing or stopping important services.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A low-privileged local process can abuse the CAP_SYS_NICE capability granted to gnome-shell to raise its own scheduler priority, starving other processes of CPU time and causing denial of service.

Why it matters to the business

Attackers who already have a foothold on a Linux desktop or server can disrupt critical services running on the same host, leading to outages and degraded system availability.

How an attack unfolds

An attacker with an unprivileged local account crafts code that leverages the existing CAP_SYS_NICE grant on gnome-shell to manipulate process scheduler parameters and elevate the priority of their own process, resulting in resource starvation for other services.

How to fix it

Update gnome-shell to a version that removes or properly restricts CAP_SYS_NICE usage; alternatively, run gnome-shell without the capability by adjusting service unit files or AppArmor/SELinux profiles and restart the session manager.

How to confirm the fix worked

Confirm gnome-shell no longer possesses CAP_SYS_NICE in its effective capability set using capsh or getcap; verify that low-privileged processes cannot raise their scheduler priority beyond normal limits after the change.

Typical attack path

  1. Obtain a low-privileged local shell or process on the affected Linux system
  2. Identify that gnome-shell holds CAP_SYS_NICE
  3. Execute code that calls sched_setscheduler or similar APIs via the capability
  4. Raise the attacker-controlled process to a higher real-time or nice priority
  5. Observe or trigger denial of service against target services

How to detect it

Review system logs for unexpected scheduler priority changes by non-root processes; inspect capability assignments on gnome-shell binaries and session-manager startup scripts for signs of tampering or unusual grants.

What your security team should do

  • Audit all systems running gnome-shell for the presence of CAP_SYS_NICE and remove it where feasible
  • Prioritize patching or configuration changes on multi-tenant or shared-host environments first
  • Monitor for any downstream package updates that address the capability handling

The record

Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with low privilege permissions, may take advantage of the way CAP_SYS_NICE is currently implemented and eventually load code to increase its process scheduler priority leading to possible DoS of other services running in the same machine.

Affected packages

Ecosystem Package Introduced Fixed
Mageia:8 gnome-shell 0 3.38.3-2.1.mga8
Ubuntu:18.04:LTS gnome-shell 0 3.28.4-0ubuntu18.04.7
Ubuntu:20.04:LTS gnome-shell 0 3.36.9-0ubuntu0.20.04.2
Ubuntu:22.04:LTS gnome-shell 0 40.5-1ubuntu2
Ubuntu:Pro:16.04:LTS gnome-shell 0 No fix

Related vulnerabilities