Red Hat Patches Linux UNIX-Socket Use-After-Free and File-Descriptor Races
Patch & Detection Intelligence · 29 sources · Updated 3mo ago · First seen Apr 19, 2022
Red Hat released kernel and live-patch updates for supported Red Hat Enterprise Linux (RHEL) 6, 7, and 8 lifecycle channels to remediate CVE-2021-0920 and CVE-2021-4083. CVE-2021-0920 is a use-after-free flaw in the UNIX-domain socket garbage collector, unix_gc(), that can enable local privilege escalation; CVE-2021-4083 is a related file-descriptor lifetime race in fget() that can leave garbage-collected socket objects reachable and trigger a read-after-free condition.
The fixes were distributed through standard kernel packages and kpatch-patch live-kernel modules for affected Extended Update Support, SAP, telecommunications, virtualization, and Real Time offerings. Several advisories also bundled fixes for other privilege-escalation, use-after-free, information-disclosure, and denial-of-service flaws, including CVE-2021-4028, CVE-2022-0330, CVE-2022-0492, and CVE-2022-22942. Administrators should apply the applicable kernel update and reboot systems where required; deployments using the supplied live-patch modules can receive covered fixes without a conventional reboot.
