CVE-2021-27364: Linux Kernel Privilege Escalation Flaw

CVE-2021-27364 Overview

CVE-2021-27364 is an out-of-bounds read vulnerability in the Linux kernel iSCSI transport subsystem. The flaw resides in drivers/scsi/scsi_transport_iscsi.c and affects all Linux kernel versions up to and including 5.11.3. An unprivileged local user can craft malicious Netlink messages to interact with the iSCSI subsystem without proper authorization checks. Successful exploitation leads to kernel memory disclosure and potential denial of service. The vulnerability was disclosed by Adam Nichols of GRIMM as part of research into long-standing iSCSI bugs in the Linux kernel.

Critical Impact
Local unprivileged users can read kernel memory and trigger denial-of-service conditions on affected Linux systems running the iSCSI transport module.

Affected Products

Linux Kernel through 5.11.3
Debian Linux 9.0 and Debian LTS releases
Canonical Ubuntu Linux 14.04 ESM, 16.04 LTS, 18.04 LTS, 20.04 LTS
NetApp SolidFire Baseboard Management Controller firmware
Oracle Tekelec Platform Distribution

Discovery Timeline

2021-03-07 - CVE-2021-27364 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-27364

Vulnerability Analysis

The vulnerability exists in the iSCSI transport subsystem implemented in drivers/scsi/scsi_transport_iscsi.c. The iSCSI subsystem exposes a Netlink interface that lacks adequate permission checks for incoming messages. Any unprivileged local user can open a Netlink socket and send crafted messages to the kernel. The kernel processes these messages without verifying that the sender holds CAP_NET_ADMIN or equivalent capabilities.

The core issue is classified as [CWE-125] Out-of-Bounds Read. When the iSCSI handler parses attacker-controlled Netlink payload fields, length validations are missing or insufficient. The kernel reads memory beyond the intended buffer boundary, exposing adjacent kernel memory contents back to userspace or destabilizing kernel state.

The iSCSI transport module is loaded automatically on many distributions when iSCSI tools are present or when triggered through related subsystems, broadening the attack surface beyond storage administrators.

Root Cause

The root cause is the absence of capability checks on the iSCSI Netlink socket combined with insufficient bounds validation on user-supplied attributes. The upstream fix in commit 688e8128b7a92df982709a4137ea4588d16f24aa adds netlink_capable checks to restrict iSCSI Netlink operations to privileged users.

Attack Vector

A local attacker authenticates as any unprivileged user, opens an NETLINK_ISCSI socket, and transmits crafted messages with malformed attribute lengths. The kernel parses the message and performs an out-of-bounds memory read. The attacker can repeat the operation to leak kernel memory addresses useful for bypassing Kernel Address Space Layout Randomization (KASLR) and chaining further privilege escalation exploits.

Full technical analysis is published in the Grimm Blog on Linux Kernel Bugs and the Openwall OSS-Security Discussion.

Detection Methods for CVE-2021-27364

Indicators of Compromise

Unexpected loading of the scsi_transport_iscsi kernel module on systems that do not use iSCSI storage.
Unprivileged processes creating NETLINK_ISCSI (protocol family 8) sockets via the socket(AF_NETLINK, SOCK_RAW, 8) syscall.
Kernel log entries referencing iSCSI transport errors or unexpected iscsi_if_recv_msg invocations.

Detection Strategies

Audit running kernel versions against patched releases using uname -r and distribution security trackers.
Monitor auditd for socket() calls with AF_NETLINK and protocol 8 originating from non-root users.
Enable kernel address sanitizer (KASAN) on test systems to detect out-of-bounds reads in the iSCSI subsystem during fuzzing.

Monitoring Recommendations

Track loaded kernel modules through lsmod snapshots and alert on libiscsi, scsi_transport_iscsi, or iscsi_tcp appearing on hosts that should not use iSCSI.
Forward kernel audit logs to a centralized SIEM and correlate Netlink socket creation by non-privileged UIDs with kernel error events.
Maintain an asset inventory mapping hosts to kernel versions to prioritize patch deployment.

How to Mitigate CVE-2021-27364

Immediate Actions Required

Apply vendor-supplied kernel updates from Debian, Ubuntu, NetApp, and Oracle that include the upstream patch.
Reboot affected systems after patching to load the corrected kernel image.
For hosts that do not require iSCSI, blacklist the scsi_transport_iscsi, libiscsi, and iscsi_tcp modules.

Patch Information

The upstream fix is committed to the Linux kernel as Linux Kernel Commit 688e8128b7a9. Distribution-specific updates are available through the Debian LTS Security Notice, NetApp Security Advisory, and the Oracle Critical Patch Update. Ubuntu users can apply the Kernel Live Patch Security Notice LSN-0075-1 for live patching without reboot.

Workarounds

Blacklist the iSCSI transport modules in /etc/modprobe.d/ to prevent automatic loading on systems that do not require iSCSI storage.
Restrict local shell access to trusted users only, since the vulnerability requires local authentication.
Deploy mandatory access control policies (SELinux or AppArmor) that constrain unprivileged processes from creating arbitrary Netlink sockets.

bash

# Blacklist iSCSI transport modules to mitigate exposure
echo "blacklist scsi_transport_iscsi" | sudo tee /etc/modprobe.d/blacklist-iscsi.conf
echo "blacklist libiscsi" | sudo tee -a /etc/modprobe.d/blacklist-iscsi.conf
echo "blacklist iscsi_tcp" | sudo tee -a /etc/modprobe.d/blacklist-iscsi.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep iscsi