CVE-2021-4203: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. The vulnerability was discovered by Jann Horn and was assigned CVE-2021-4203. The issue affects Linux kernel versions prior to 5.15-rc4 (Kernel Commit).

The vulnerability stems from a race condition in the socket subsystem where af_unix can concurrently change sk_peer_pid and sk_peer_cred fields. The issue occurs specifically in the SO_PEERCRED and SO_PEERGROUPS implementations. The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (MEDIUM) with the vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

A successful exploitation of this vulnerability could allow an attacker with user privileges to crash the system or leak internal kernel information. The vulnerability could lead to disclosure of sensitive information or Denial of Service (DoS) (NetApp Advisory).

The vulnerability requires user privileges to exploit and has high attack complexity. The attack vector is network-based, but requires no user interaction to exploit. The vulnerability has been classified with high confidentiality and availability impact ratings, but no integrity impact (NVD).

The issue was fixed in Linux kernel version 5.15-rc4 by adding a new spinlock that needs to be used whenever these fields are read or written. The fix involves proper synchronization of access to sk_peer_pid and sk_peer_cred fields using the newly introduced sk_peer_lock (Kernel Commit).