Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 05 Feb 2021 18:33:26 +0300
From: Alexander Popov <>
To: oss-security <>
CC:,Linus Torvalds <>,Greg KH <>,"" <>,Norbert Slusarek <>,Stefano Garzarella <>,Eric Dumazet <>,Anthony Liguori <>,David Miller <>,Jakub Kicinski <>,Jorgen Hansen <>,Stefan Schmidt <>,Jeff Vander Stoep <>,Andrey Konovalov <>
Subject: Re: Linux kernel: Exploitable vulnerabilities in AF_VSOCK implementation

On February 5, 2021 12:43:31 AM GMT+03:00, Alexander Popov <> wrote:
>Let me inform you about the Linux kernel vulnerabilities that I've
>found in
>AF_VSOCK implementation. I managed to exploit one of them for a local
>escalation on Fedora Server 33 for x86_64, bypassing SMEP and SMAP. I'm
>going to
>share all the details about the exploit techniques later.
>modules in all
>major GNU/Linux distributions. The vulnerable modules are automatically
>when you create a socket for AF_VSOCK. That is available for
>unprivileged users
>and user namespaces are not needed for that.
>These vulnerabilities are race conditions caused by wrong locking in
>net/vmw_vsock/af_vsock.c. The race conditions were implicitly
>introduced in
>November 2019 in the commits c0cfa2d8a788fcf4 and 6a2c0962105ae8ce that
>VSOCK multi-transport support. These commits were merged in the Linux
>I prepared the fixing patch and made responsible disclosure to
> Now the patch is merged into the mainline kernel:
>  "vsock: fix the race conditions in multi-transport support"
>This patch is also backported into the affected stable trees.
>I've requested a CVE ID for these vulnerabilities at

CVE-2021-26708 is assigned to these issues:

Best regards,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.