CVE-2021-23133: Broadcom Brocade Fabric Operating System
High severity, CVSS 7.0. EPSS: 0.5% chance of exploitation in the next 30 days.
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.
Affected products
- Broadcom Brocade Fabric Operating System: affected versions not specified
- Debian Debian Linux: version 9.0 only
- Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
- Linux Linux Kernel: before 4.4.269 (fixed in 4.4.269); from 4.5, before 4.9.269 (fixed in 4.9.269); from 4.10, before 4.14.233 (fixed in 4.14.233); from 4.15, before 4.19.191 (fixed in 4.19.191); from 4.20, before 5.4.119 (fixed in 5.4.119); from 5.5, before 5.10.37 (fixed in 5.10.37); …
- Netapp Cloud Backup: affected versions not specified
- Netapp h300e Firmware: affected versions not specified
- Netapp h300s Firmware: affected versions not specified
- Netapp h410c Firmware: affected versions not specified
- Netapp h410s Firmware: affected versions not specified
- Netapp h500e Firmware: affected versions not specified
- Netapp h500s Firmware: affected versions not specified
- Netapp h700e Firmware: affected versions not specified
- Netapp h700s Firmware: affected versions not specified
- Netapp Solidfire & Hci Management Node: affected versions not specified
- Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified
Published 2021-04-22. Last modified 2026-07-30.