CVE-2021-46971

What it actually does

Unconditional call to security_locked_down() hook even when PERF_SAMPLE_REGS_INTR bit is not set in perf event attributes, leading to spurious SELinux permission checks and audit records.

Why it matters to the business

Generates excessive and irrelevant audit logs in SELinux-enabled systems when using perf, potentially complicating log analysis and compliance auditing without providing security benefit.

How an attack unfolds

No active exploitation path exists; the flaw is a logic error in the kernel that causes unnecessary SELinux hook invocations and audit records during perf event setup when register sampling is not requested.

How to fix it

Apply the upstream kernel fix that checks sample_type before invoking the lockdown hook; rebuild and deploy updated kernel packages across affected systems.

How to confirm the fix worked

Confirm that perf event creation without PERF_SAMPLE_REGS_INTR no longer triggers lockdown class permission checks or audit records in SELinux logs.

Typical attack path

1. Create perf event with sample_type lacking PERF_SAMPLE_REGS_INTR
2. Trigger unconditional lockdown hook call
3. Generate spurious SELinux permission check and audit record

How to detect it

Inspect SELinux audit logs for repeated lockdown permission checks tied to perf events that do not request register sampling.

What your security team should do

• Prioritize kernel updates containing the perf/core fix on SELinux-enabled systems
• Review and tune SELinux audit rules to reduce noise from lockdown checks
• Test perf workloads post-update to ensure expected behavior