Saint Four Bytes, Mighty in the Little

Patron of virtual-machine sockets, kernel race conditions, and those who get a lot from a tiny write.

Life

On 9 February 2021 Alexander Popov described CVE-2021-26708: several race conditions in the Linux kernel's AF_VSOCK code, introduced when multi-transport support was added for virtual-machine sockets. Using them, a local user got a controlled write of just four bytes in memory; Popov turned it, step by step, into administrator privileges on Fedora 33. The flaw was fixed in kernel 5.10.13.

Prayer

O Saint Four Bytes, who does great things with a small write, teach the kernel to close every race before it begins. Amen.

How to celebrate

Celebrated by updating the Linux kernel to 5.10.13 or later and disabling the network modules you don't need.

Four bytes in the right place are worth a key.