Loading vulnerability…
CVE-2021-4154 is a use-after-free vulnerability in the Linux kernel cgroup v1 parser's cgroup1_parse_param function. Improper lifetime handling during fsconfig syscall parameter processing can be triggered by a local user, resulting in use of freed kernel memory.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains two C-based exploits (exp.c and kctf_exp.c) for CVE-2021-4154, a Linux kernel use-after-free vulnerability in the fsconfig syscall. The exploit targets several major Linux distributions (CentOS, Debian, Fedora, Ubuntu) with specific kernel versions prior to the upstream patch. The exploit works by manipulating file descriptors and kernel memory to overwrite privileged files (such as /etc/passwd) or hijack kernel execution, resulting in local privilege escalation to root. The exp.c file implements a reliable privilege escalation by overwriting /etc/passwd, while kctf_exp.c demonstrates a more advanced exploitation technique involving kernel ROP chains and namespace manipulation, ultimately spawning a root shell. The repository also includes a detailed writeup (WRITEUP.md) explaining the vulnerability, exploitation primitives, and technical background. The exploit requires local code execution on a vulnerable system and does not require network access. Several system and kernel configuration files are accessed or modified during exploitation, and the attack is purely local. The code is operational and can be adapted for different kernel versions with some modification.
This repository contains a local privilege escalation exploit for CVE-2021-4154, targeting the Linux kernel. The main exploit logic is implemented in 'exp.c', which leverages a use-after-free vulnerability in the cgroup filesystem to gain write access to arbitrary files, specifically targeting '/etc/passwd' to escalate privileges. The exploit sets up a controlled environment using user, mount, and network namespaces, and uses a combination of file descriptor manipulation and race conditions to achieve the exploit. The 'boot.sh' script is used to launch a QEMU virtual machine with a custom kernel and initrd, providing a safe environment for testing the exploit. The Makefile automates the build and test process. The repository is structured for ease of use in CTF or research environments, and demonstrates a working privilege escalation attack on vulnerable Linux systems.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel fsconfig syscall parameter flaw enabling local privilege escalation and potential container breakout.
A Linux kernel fsconfig syscall parameter flaw enabling local privilege escalation and potential container breakout.
A Linux kernel fsconfig syscall parameter flaw enabling local privilege escalation and potential container breakout.
A Linux kernel local privilege-escalation vulnerability involving the fsconfig syscall parameter that can enable a container breakout.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.