CVE-2021-4037
linux: A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local u...
CVE-2021-4037 is fixed in 38 products on 1 platform, first by RHSA-2022:1988, released May 10, 2022. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
8.2
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0034
27th percentile
A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bpftool · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| bpftool · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| bpftool · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel · rocky 8 | 0:4.18.0-372.9.1.el8 | RLSA-2022:1988 | May 10, 2022 |
| kernel-abi-stablelists · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-abi-stablelists · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-abi-stablelists · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-core · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-core · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-core · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-cross-headers · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-cross-headers · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-debug · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-debug · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-debug · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-debug-core · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-debug-core · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-debug-core · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-debug-devel · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-debug-devel · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-debug-devel · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-debug-modules · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-debug-modules · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-debug-modules · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-debug-modules-extra · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-debug-modules-extra · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-debug-modules-extra · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-devel · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-devel · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-devel · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-doc · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-doc · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-doc · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-headers · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-headers · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-modules · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-modules · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-modules · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-modules-extra · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-modules-extra · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-modules-extra · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-rt · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt · rocky 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RLSA-2022:1975 | May 10, 2022 |
| kernel-rt-core · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-debug · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-debug-core · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-debug-devel · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-debug-kvm · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-debug-modules · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-debug-modules-extra · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-devel · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-kvm · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-modules · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-rt-modules-extra · RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 | May 10, 2022 |
| kernel-tools · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-tools · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-tools · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-tools-libs · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-tools-libs · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-tools-libs · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-tools-libs-devel · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-tools-libs-devel · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| kernel-tools-libs-devel · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| kernel-zfcpdump · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-zfcpdump-core · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-zfcpdump-devel · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-zfcpdump-modules · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| kernel-zfcpdump-modules-extra · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| linux · Debian 11.6 (bullseye) | 5.10.149-1 | DSA-5257-1 | Oct 18, 2022 |
| linux · Debian 12.15 (bookworm) | 5.14.6-1 | DEBIAN-CVE-2021-4037 | Aug 24, 2022 |
| linux · Debian 13.5 (trixie) | 5.14.6-1 | DEBIAN-CVE-2021-4037 | Aug 24, 2022 |
| linux · Debian 14 | 5.14.6-1 | DEBIAN-CVE-2021-4037 | Aug 24, 2022 |
| perf · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| perf · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| perf · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
| python3-perf · RHEL 8 | 0:4.18.0-372.9.1.el8 | RHSA-2022:1988 | May 10, 2022 |
| python3-perf · almalinux 8 | 4.18.0-372.9.1.el8 | ALSA-2022:1988 | May 10, 2022 |
| python3-perf · ol 8 | 0:4.18.0-372.9.1.el8 | ELSA-2022-1988 | May 17, 2022 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.