CVE-2021-26708: 
Linux Kernel vulnerability analysis and mitigation

A local privilege escalation vulnerability (CVE-2021-26708) was discovered in the Linux kernel before version 5.10.13. The vulnerability stems from multiple race conditions in the AF_VSOCK implementation caused by wrong locking in net/vmw_vsock/af_vsock.c. These race conditions were implicitly introduced in November 2019 through commits that added VSOCK multi-transport support, which were merged in Linux kernel v5.5-rc1 (Openwall List).

The vulnerability exists in the AF_VSOCK implementation where the bug pattern involves: 1) vsock_sock.transport pointer is copied to a local variable, 2) lock_sock() is called, and 3) the local variable is used. The VSOCK multi-transport support introduced a race condition where vsock_sock.transport value may change between steps 1 and 2. The vulnerability received a CVSS v3.1 Base Score of 7.0 (HIGH) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, NetApp Advisory).

Successful exploitation of this vulnerability could lead to local privilege escalation, allowing an attacker to bypass SMEP and SMAP protections. The vulnerability affects systems where CONFIG_VSOCKETS and CONFIG_VIRTIO_VSOCKETS are shipped as kernel modules, which are automatically loaded when creating a socket for AF_VSOCK. This functionality is available to unprivileged users and doesn't require user namespaces (Openwall List).

The vulnerability has been demonstrated to be exploitable for local privilege escalation on Fedora Server 33 for x86_64, successfully bypassing SMEP and SMAP protections. A detailed exploit has been published that shows how to gain local privilege escalation (Openwall List).

The vulnerability was fixed in Linux kernel version 5.10.13 with a patch that modifies the code to copy vsock_sock.transport pointer to local variables after the lock_sock() call. The fix was also backported to affected stable trees (Kernel Changelog, Git Commit).