CVE-2021-4083

What it actually does

Read-after-free in Linux kernel Unix domain socket garbage collection triggered by concurrent close() and fget() calls allowing local privilege escalation or denial of service via race condition.

Why it matters to the business

Local attackers on affected Linux systems can crash machines or gain elevated privileges, leading to service disruption and potential unauthorized access to sensitive workloads.

How an attack unfolds

An attacker with local access triggers a race between socket close and file descriptor reference operations during garbage collection, causing a use-after-free that is leveraged to corrupt kernel memory and either panic the system or execute code with higher privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit 054aa8d439b9 or later (5.16-rc4 and subsequent stable releases). Rebuild and reboot with the patched kernel; apply vendor backports where available for supported distributions.

How to confirm the fix worked

Verify the running kernel version or git commit contains 054aa8d439b9; attempt to reproduce the race with known test cases in a controlled environment and confirm no crash or escalation occurs.

Typical attack path

1. Obtain local shell access on target Linux host
2. Compile and run a program that concurrently invokes close() and fget() on Unix domain sockets
3. Trigger the race repeatedly until memory corruption occurs
4. Use resulting primitive for privilege escalation or kernel crash

How to detect it

Review kernel logs for oops or panic messages involving unix socket file descriptor handling and garbage collection; correlate with processes performing rapid socket close operations.

What your security team should do

• Prioritize kernel updates on all Linux systems exposed to untrusted local users
• Monitor for new backported patches from distribution vendors
• Restrict local user accounts and sandbox untrusted processes until patches are applied