Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.7
CVE-2021-39656: Linux Azure/AWS/GCP kernels may allow attackers to gain system rights
CVE-2021-39656 · published 4 years ago
Summary
The Linux kernels provided by Canonical for Azure, AWS, GCP, and the HWE series contain a coding error that could let a local user obtain full system privileges without any user interaction. This could let an attacker run any code with the same authority as the operating system itself. Install the latest kernel updates from Canonical as soon as they are available to fix the issue.
What to do
- Update canonical linux-azure to version 4.15.0-1115.128~14.04.1.
- Update canonical linux-aws-hwe to version 4.15.0-1103.110~16.04.1.
- Update canonical linux-azure to version 4.15.0-1115.128~16.04.1.
- Update canonical linux-gcp to version 4.15.0-1100.113~16.04.1.
- Update canonical linux-hwe to version 4.15.0-144.148~16.04.1.
- Update canonical linux-oracle to version 4.15.0-1072.80~16.04.1.
- Update canonical linux to version 4.15.0-144.148.
- Update canonical linux-aws to version 4.15.0-1103.110.
- Update canonical linux-aws-5.4 to version 5.4.0-1048.50~18.04.1.
- Update canonical linux-azure-4.15 to version 4.15.0-1115.128.
- Update canonical linux-azure-5.4 to version 5.4.0-1047.49~18.04.1.
- Update canonical linux-dell300x to version 4.15.0-1022.26.
- Update canonical linux-gcp-4.15 to version 4.15.0-1100.113.
- Update canonical linux-gcp-5.4 to version 5.4.0-1043.46~18.04.1.
- Update canonical linux-gke-5.4 to version 5.4.0-1043.45~18.04.1.
- Update canonical linux-gkeop-5.4 to version 5.4.0-1015.16~18.04.1.
- Update canonical linux-hwe-5.4 to version 5.4.0-73.82~18.04.1.
- Update canonical linux-kvm to version 4.15.0-1092.94.
- Update canonical linux-oracle to version 4.15.0-1072.80.
- Update canonical linux-oracle-5.4 to version 5.4.0-1044.47~18.04.1.
- Update canonical linux-raspi-5.4 to version 5.4.0-1035.38~18.04.1.
- Update canonical linux-raspi2 to version 4.15.0-1086.91.
- Update canonical linux-snapdragon to version 4.15.0-1103.112.
- Update canonical linux-aws-fips to version 4.15.0-2045.47.
- Update canonical linux-azure-fips to version 4.15.0-2027.30.
- Update canonical linux-fips to version 4.15.0-1060.68.
- Update canonical linux to version 5.4.0-73.82.
- Update canonical linux-aws to version 5.4.0-1048.50.
- Update canonical linux-azure to version 5.4.0-1047.49.
- Update canonical linux-gcp to version 5.4.0-1043.46.
- Update canonical linux-gke to version 5.4.0-1043.45.
- Update canonical linux-gkeop to version 5.4.0-1015.16.
- Update canonical linux-kvm to version 5.4.0-1039.40.
- Update canonical linux-oem-5.10 to version 5.10.0-1021.22.
- Update canonical linux-oracle to version 5.4.0-1045.49.
- Update canonical linux-raspi to version 5.4.0-1035.38.
- Update canonical linux-aws-fips to version 5.4.0-1069.73+fips2.
- Update canonical linux-azure-fips to version 5.4.0-1073.76+fips1.
- Update canonical linux-gcp-fips to version 5.4.0-1067.71~20.04.1.
- Update google :linux_kernel: to version :2021-12-05.
- Update debian linux to version 5.10.24-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure |
< 4.15.0-1115.128~14.04.1 Fix: upgrade to 4.15.0-1115.128~14.04.1
|
| Ubuntu:Pro:16.04:LTS | canonical | linux-aws-hwe |
< 4.15.0-1103.110~16.04.1 Fix: upgrade to 4.15.0-1103.110~16.04.1
|
| Ubuntu:Pro:16.04:LTS | canonical | linux-azure |
< 4.15.0-1115.128~16.04.1 Fix: upgrade to 4.15.0-1115.128~16.04.1
|
| Ubuntu:Pro:16.04:LTS | canonical | linux-gcp |
< 4.15.0-1100.113~16.04.1 Fix: upgrade to 4.15.0-1100.113~16.04.1
|
| Ubuntu:Pro:16.04:LTS | canonical | linux-hwe |
< 4.15.0-144.148~16.04.1 Fix: upgrade to 4.15.0-144.148~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-oracle |
< 4.15.0-1072.80~16.04.1 Fix: upgrade to 4.15.0-1072.80~16.04.1
|
| Ubuntu:18.04:LTS | canonical | linux |
< 4.15.0-144.148 Fix: upgrade to 4.15.0-144.148
|
| Ubuntu:18.04:LTS | canonical | linux-aws |
< 4.15.0-1103.110 Fix: upgrade to 4.15.0-1103.110
|
| Ubuntu:18.04:LTS | canonical | linux-aws-5.4 |
< 5.4.0-1048.50~18.04.1 Fix: upgrade to 5.4.0-1048.50~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-azure-4.15 |
< 4.15.0-1115.128 Fix: upgrade to 4.15.0-1115.128
|
| Ubuntu:18.04:LTS | canonical | linux-azure-5.4 |
< 5.4.0-1047.49~18.04.1 Fix: upgrade to 5.4.0-1047.49~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-dell300x |
< 4.15.0-1022.26 Fix: upgrade to 4.15.0-1022.26
|
| Ubuntu:18.04:LTS | canonical | linux-gcp-4.15 |
< 4.15.0-1100.113 Fix: upgrade to 4.15.0-1100.113
|
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.4 |
< 5.4.0-1043.46~18.04.1 Fix: upgrade to 5.4.0-1043.46~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 |
< 5.4.0-1043.45~18.04.1 Fix: upgrade to 5.4.0-1043.45~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 |
< 5.4.0-1015.16~18.04.1 Fix: upgrade to 5.4.0-1015.16~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-hwe-5.4 |
< 5.4.0-73.82~18.04.1 Fix: upgrade to 5.4.0-73.82~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-kvm |
< 4.15.0-1092.94 Fix: upgrade to 4.15.0-1092.94
|
| Ubuntu:18.04:LTS | canonical | linux-oracle |
< 4.15.0-1072.80 Fix: upgrade to 4.15.0-1072.80
|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.4 |
< 5.4.0-1044.47~18.04.1 Fix: upgrade to 5.4.0-1044.47~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-raspi-5.4 |
< 5.4.0-1035.38~18.04.1 Fix: upgrade to 5.4.0-1035.38~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-raspi2 |
< 4.15.0-1086.91 Fix: upgrade to 4.15.0-1086.91
|
| Ubuntu:18.04:LTS | canonical | linux-snapdragon |
< 4.15.0-1103.112 Fix: upgrade to 4.15.0-1103.112
|
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips |
< 4.15.0-2045.47 Fix: upgrade to 4.15.0-2045.47
|
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips |
< 4.15.0-2027.30 Fix: upgrade to 4.15.0-2027.30
|
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-fips |
< 4.15.0-1060.68 Fix: upgrade to 4.15.0-1060.68
|
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:20.04:LTS | canonical | linux |
< 5.4.0-73.82 Fix: upgrade to 5.4.0-73.82
|
| Ubuntu:20.04:LTS | canonical | linux-aws |
< 5.4.0-1048.50 Fix: upgrade to 5.4.0-1048.50
|
| Ubuntu:20.04:LTS | canonical | linux-azure |
< 5.4.0-1047.49 Fix: upgrade to 5.4.0-1047.49
|
| Ubuntu:20.04:LTS | canonical | linux-gcp |
< 5.4.0-1043.46 Fix: upgrade to 5.4.0-1043.46
|
| Ubuntu:20.04:LTS | canonical | linux-gke |
< 5.4.0-1043.45 Fix: upgrade to 5.4.0-1043.45
|
| Ubuntu:20.04:LTS | canonical | linux-gkeop |
< 5.4.0-1015.16 Fix: upgrade to 5.4.0-1015.16
|
| Ubuntu:20.04:LTS | canonical | linux-kvm |
< 5.4.0-1039.40 Fix: upgrade to 5.4.0-1039.40
|
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 |
< 5.10.0-1021.22 Fix: upgrade to 5.10.0-1021.22
|
| Ubuntu:20.04:LTS | canonical | linux-oracle |
< 5.4.0-1045.49 Fix: upgrade to 5.4.0-1045.49
|
Showing 50 of 76. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-raspi |
< 5.4.0-1035.38 Fix: upgrade to 5.4.0-1035.38
|
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-aws-fips |
< 5.4.0-1069.73+fips2 Fix: upgrade to 5.4.0-1069.73+fips2
|
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-azure-fips |
< 5.4.0-1073.76+fips1 Fix: upgrade to 5.4.0-1073.76+fips1
|
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-gcp-fips |
< 5.4.0-1067.71~20.04.1 Fix: upgrade to 5.4.0-1067.71~20.04.1
|
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:26.04 | canonical | linux-nvidia | All versions |
| Android | :linux_kernel: |
>= :0, < :2021-12-05 Fix: upgrade to :2021-12-05
|
|
| – | android |
All versions
cpe:2.3:o:google:android:-:*:*:*:*:*:*:* |
|
| Debian:12 | debian | linux |
< 5.10.24-1 Fix: upgrade to 5.10.24-1
|
Original advisory text
In __configfs_open_file of file.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed...
In __configfs_open_file of file.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.
References
- https://ubuntu.com/security/CVE-2021-39656 Third Party Advisory
- https://git.kernel.org/linus/14fbbc8297728e880070f7b077b3301a8c698ef9 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-39656 Third Party Advisory
- https://source.android.com/security/bulletin/2021-12-01 Vendor Advisory
- https://android.googlesource.com/kernel/common/+/14fbbc8297728e880070f7b077b3301... Patch
- https://source.android.com/security/bulletin/pixel/2021-12-01 Patch Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-39656 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-416Use After Free
CWE-667Improper Locking
Timeline
Published1 Dec 2021
Updated26 Oct 2026
First seen12 May 2026
Sources
UBUNTU-CVE-2021-39656 · OSV
CVE-2021-39656 · NVD
PUB-A-174049066 · OSV
DEBIAN-CVE-2021-39656 · OSV
Track software like this
Free during beta