Improper authentication in kernel
Priority LOW 35CWE-287Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.
Summary
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.
Why it matters now
EPSS 0.00536 45th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | kernel | Linux kernel 5.17-rc1 | — | No fix listed | CNA |
- kernel Vendor— Affected Linux kernel 5.17-rc1 Fixed in — No fix listed CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.2 to before 4.14.276; 4.15 to before 4.19.238; 4.20 to before 5.4.189; 5.5 to before 5.10.111; 5.11 to before 5.15.14 | Vulnerable | Linux |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.1:*:*:*:*:*:*:* | 22.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* | 22.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.2.0:*:*:*:*:*:*:* | 22.2.0 | Vulnerable | Oracle |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Broadcom |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.2 to before 4.14.276; 4.15 to before 4.19.238; 4.20 to before 5.4.189; 5.5 to before 5.10.111; 5.11 to before 5.15.14 Vulnerable ·Linux
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.1:*:*:*:*:*:*:* Versions 22.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.2.0:*:*:*:*:*:*:* Versions 22.2.0 Vulnerable ·Oracle
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
Red Hat 4 advisories
- RHSA-2022:5626 Released 2022-07-19 · Red Hat rating Importantkernel security and bug fix update
- Red Hat Enterprise Linux BaseOS EUS (v.8.4) bpftool-4.18.0-305.57.1.el8_4, kernel-4.18.0-305.57.1.el8_4, kernel-abi-stablelists-4.18.0-305.57.1.el8_4 +19
- Red Hat Enterprise Linux CRB EUS (v.8.4) kernel-tools-libs-devel-4.18.0-305.57.1.el8_4
- RHSA-2022:5633 Released 2022-07-19 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux NFV EUS (v.8.4) kernel-rt-4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-core-4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-debug-4.18.0-305.57.1.rt7.129.el8_4 +9
- Red Hat Enterprise Linux RT EUS (v.8.4) kernel-rt-4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-core-4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-debug-4.18.0-305.57.1.rt7.129.el8_4 +7
- RHSA-2022:1988 Released 2022-05-10 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-372.9.1.el8, kernel-4.18.0-372.9.1.el8, kernel-abi-stablelists-4.18.0-372.9.1.el8 +19
- Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-372.9.1.el8
Show 1 more Red Hat advisories
- RHSA-2022:1975 Released 2022-05-10 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-372.9.1.rt7.166.el8, kernel-rt-core-4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-4.18.0-372.9.1.rt7.166.el8 +9
- Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-372.9.1.rt7.166.el8, kernel-rt-core-4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-4.18.0-372.9.1.rt7.166.el8 +7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2022:1988 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.4) | Fixed | RHSA-2022:5626 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2022:1988 |
| Red Hat Enterprise Linux CRB EUS (v.8.4) | Fixed | RHSA-2022:5626 |
| Red Hat Enterprise Linux NFV (v. 8) | Fixed | RHSA-2022:1975 |
| Red Hat Enterprise Linux NFV EUS (v.8.4) | Fixed | RHSA-2022:5633 |
| Red Hat Enterprise Linux RT (v. 8) | Fixed | RHSA-2022:1975 |
| Red Hat Enterprise Linux RT EUS (v.8.4) | Fixed | RHSA-2022:5633 |
Not affected: 3 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-4197
References
Sources
- CVE-2021-4197 · CVE Program
- CVE-2021-4197 · NVD
- FIRST EPSS
- CVE-2021-4197 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences