CVE-2021-3759: Linux Kernel Memory Overflow DoS Vulnerability

CVE-2021-3759 Overview

A memory overflow vulnerability was found in the Linux kernel's IPC functionality of the memcg subsystem. The flaw exists in the way a user calls the semget function multiple times, creating semaphores without proper resource accounting. This vulnerability allows a local user to starve system resources, causing a denial of service condition. The highest threat from this vulnerability is to system availability.

Critical Impact
Local attackers can exploit this vulnerability to exhaust system memory resources through repeated semaphore creation, leading to denial of service conditions affecting system availability.

Affected Products

Linux Linux Kernel
Debian Linux 10.0

Discovery Timeline

2022-08-23 - CVE CVE-2021-3759 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3759

Vulnerability Analysis

This vulnerability represents a resource exhaustion flaw (CWE-400) combined with improper allocation of resources without limits (CWE-770) within the Linux kernel's memory control group (memcg) subsystem. The IPC mechanism responsible for managing System V semaphores fails to properly account for memory allocations when semaphores are created repeatedly.

When a local user invokes the semget system call multiple times to create semaphores, the kernel does not adequately track or limit the memory resources consumed by these operations within the memcg framework. This oversight allows an attacker to continuously allocate semaphores without proper resource constraints, eventually exhausting available system memory.

The vulnerability requires local access to the system and low privileges to exploit. No user interaction is required for successful exploitation, making it accessible to any authenticated local user.

Root Cause

The root cause lies in the incomplete integration between the IPC semaphore subsystem and the memcg memory accounting framework. When semaphores are allocated through semget, the associated kernel memory structures are not properly charged to the user's memory control group. This creates a blind spot in resource tracking, allowing unbounded resource consumption that bypasses memcg limits designed to prevent exactly this type of resource exhaustion attack.

Attack Vector

Exploitation occurs through repeated invocation of the semget system call from a local user context. The attacker creates numerous semaphores in rapid succession, each consuming kernel memory without proper accounting. Since the memory is not tracked against the user's cgroup limits, the attacker can continue allocating resources until system memory is exhausted, affecting all processes on the system and causing a denial of service condition.

The attack is straightforward to execute, requiring only basic programming knowledge to write a loop that continuously calls semget with appropriate parameters. No special privileges beyond standard local user access are required.

Detection Methods for CVE-2021-3759

Indicators of Compromise

Unusually high number of semaphore allocations from a single user or process
Rapid memory consumption by kernel IPC structures without corresponding memcg accounting
System memory pressure alerts coinciding with high semget system call activity
Processes creating excessive semaphores detected in /proc/sysvipc/sem

Detection Strategies

Monitor semget system call frequency using auditd or syscall tracing mechanisms
Implement alerts for abnormal semaphore creation rates per user or process
Track kernel memory allocation patterns for IPC structures using kernel memory profiling tools
Use SentinelOne's behavioral detection to identify resource exhaustion patterns

Monitoring Recommendations

Enable system call auditing for semget operations to track semaphore creation activity
Monitor /proc/sysvipc/sem for unusual growth in semaphore counts
Configure memory pressure alerts to detect early signs of resource exhaustion
Implement rate limiting for IPC resource creation at the application level where possible

How to Mitigate CVE-2021-3759

Immediate Actions Required

Apply the latest kernel security updates from your Linux distribution vendor
Review and restrict local user access to prevent unauthorized exploitation
Implement resource limits using cgroups where possible to constrain IPC resource usage
Monitor systems for signs of active exploitation attempts

Patch Information

Kernel patches addressing this vulnerability have been released. Organizations should consult their Linux distribution's security advisories for specific patch versions:

Red Hat CVE-2021-3759 Advisory - Official Red Hat security guidance
Red Hat Bug Report #1999675 - Detailed bug tracking information
Debian LTS Security Announcement - Debian security updates
Kernel Mailing List Thread - Original kernel patch discussion

Workarounds

Restrict local system access to trusted users only until patches can be applied
Implement system-wide semaphore limits using sysctl parameters such as kernel.sem
Use SELinux or AppArmor policies to restrict semget system call access for untrusted processes
Monitor and alert on excessive IPC resource creation as a compensating control

bash

# Configuration example - Restrict semaphore limits
# Edit /etc/sysctl.conf or create /etc/sysctl.d/99-ipc-hardening.conf
sysctl -w kernel.sem="250 32000 32 128"

# Apply sysctl changes
sysctl -p

# Monitor current semaphore usage
ipcs -s