CVE-2021-43057

What it actually does

Use-after-free vulnerability in selinux_ptrace_traceme allows local attackers to access stale subjective credentials of another task, resulting in memory corruption that can be leveraged for privilege escalation.

Why it matters to the business

Local attackers on unpatched Linux systems can escalate privileges to root, leading to full host compromise, data theft, persistence, or lateral movement; the issue affects a wide range of kernels still in use despite the age of the disclosure.

How an attack unfolds

An attacker with a local account crafts a process that invokes ptrace with PTRACE_TRACEME against a target task; the SELinux handler dereferences freed credential structures, enabling memory corruption primitives that are turned into arbitrary code execution and root access. Public exploits for this kernel flaw have been available since disclosure.

How to fix it

Upgrade the Linux kernel to version 5.14.8 or later, or apply commit a3727a8bac0a9e77c70820655fd8715523ba3db7 from the mainline repository; rebuild and reboot into the fixed kernel. Where live patching is available, apply the vendor-supplied patch for the running kernel series.

How to confirm the fix worked

Confirm the running kernel version is 5.14.8 or newer; inspect /proc/version or uname output; verify the SELinux ptrace hook no longer contains the vulnerable dereference by reviewing the patched source or running kernel symbol checks.

Typical attack path

1. Obtain local shell on target Linux host
2. Compile or execute exploit code that triggers selinux_ptrace_traceme via PTRACE_TRACEME
3. Trigger use-after-free to corrupt kernel memory
4. Escalate to root via corrupted credentials or ROP chain
5. Install persistence, exfiltrate data, or move laterally

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or use-after-free warnings involving selinux_ptrace_traceme or credential structures; inspect audit logs for unusual ptrace activity by unprivileged users; correlate with process creation events around the time of suspected exploitation.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-tenant Linux systems within the next 30 days
• Enable kernel lockdown or SELinux enforcing mode where operationally feasible to reduce attack surface
• Monitor for new local privilege-escalation attempts and schedule periodic kernel updates as part of standard patching cadence