Loading vulnerability…
Use-after-free in Linux kernel cgroup v1 parser
CVE-2021-4154 is a use-after-free vulnerability in the Linux kernel's cgroup v1 parser, specifically in cgroup1_parse_param(). A local attacker with user-level privileges can exploit fsconfig syscall parameter handling to escalate privileges, escape a container, or cause a host denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise host security through local privilege escalation and container breakout. Exploitation can also cause denial of service on the host system. The vulnerability affects the shared host kernel, so its consequences are not necessarily confined to the originating container.
If you can’t patch tonight, do this now.
Until patched, reduce exposure by preventing untrusted local users or container tenants from accessing vulnerable hosts and by avoiding cgroup v1 where operationally feasible. Restricting the ability to invoke relevant filesystem-configuration operations can further reduce exposure, but patching is the definitive mitigation.
Patch, then assume compromise.
Install the applicable vendor kernel update containing the fix and reboot into the updated kernel. Fixed RHEL packages include kernel 4.18.0-305.34.2.el8_4 under RHSA-2022:0186 and kernel 4.18.0-348.20.1.el8_5 under RHSA-2022:0825. Corresponding real-time kernel fixes are available under RHSA-2022:0187 and RHSA-2022:0819. Supported RHEL deployments can alternatively apply the matching kpatch live update under RHSA-2022:0231 or RHSA-2022:0849 without a conventional reboot. For affected Android devices, install a vendor update with security patch level 2022-06-05 or later.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.