high 7.8

CVE-2021-4037 json

Kernel: security regression for cve-2018-13405

published 2022-08-24 4y ago modified 2026-10-14 26d ago also EUVD-2021-33937

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.

Patch / fix

fixed in 4 distros 6 links 2

Linux kernel 5.4.241, 5.10.146, 5.12
Red Hat Red Hat Enterprise Linux 8 0:4.18.0-372.9.1.el8, 0:4.18.0-372.9.1.rt7.166.el8
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support 0:4.18.0-305.49.1.el8_4, 0:4.18.0-305.49.1.rt7.121.el8_4
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1

debian ubuntu red hat suse almalinux rocky linux

linux Debian 14, Debian 13, Debian 12 5.14.6-1

debian advisories DEBIAN-CVE-2021-4037

linux Ubuntu 18.04 LTS 4.15.0-166.174
linux Ubuntu 20.04 LTS 5.4.0-92.103
linux-aws Ubuntu 18.04 LTS 4.15.0-1118.125
linux-aws Ubuntu 20.04 LTS 5.4.0-1061.64
linux-gcp Ubuntu 20.04 LTS 5.4.0-1059.63
linux-gke Ubuntu 20.04 LTS 5.4.0-1057.60
linux-ibm Ubuntu 20.04 LTS 5.4.0-1010.11
linux-kvm Ubuntu 18.04 LTS 4.15.0-1105.107

ubuntu advisories UBUNTU-CVE-2021-4037

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 8 4.18.0-372.9.1.el8
perf RHEL 8 4.18.0-372.9.1.el8
bpftool RHEL 8 4.18.0-372.9.1.el8
kernel-core RHEL 8 4.18.0-372.9.1.el8
kernel-tools RHEL 8 4.18.0-372.9.1.el8
python3-perf RHEL 8 4.18.0-372.9.1.el8
kernel-modules RHEL 8 4.18.0-372.9.1.el8
kernel-zfcpdump RHEL 8 4.18.0-372.9.1.el8

red hat advisories RHSA-2022:1988 RHSA-2022:4829 RHSA-2022:4835 RHSA-2022:1975

kernel-rt Real Time Module 15 SP4, openSUSE Leap 15.4 5.14.21-150400.15.5.1
kernel-syms-rt Real Time Module 15 SP4, openSUSE Leap 15.4 5.14.21-150400.15.5.1
kernel-rt_debug Real Time Module 15 SP4, openSUSE Leap 15.4 5.14.21-150400.15.5.1
kernel-source-rt Real Time Module 15 SP4, openSUSE Leap 15.4 5.14.21-150400.15.5.1
kernel-syms SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.114.1
kernel-source SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.114.1
kernel-default SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLE Live Patching 12 SP4 +3 more 4.12.14-95.114.1
kernel-rt SLE Real Time 12 SP5 4.12.14-10.109.1

suse advisories SUSE-SU-2022:4617-1 SUSE-SU-2022:4615-1 SUSE-SU-2022:4614-1 SUSE-SU-2022:4611-1 SUSE-SU-2022:4589-1 SUSE-SU-2022:4574-1

kernel AlmaLinux 8 4.18.0-372.9.1.el8
perf AlmaLinux 8 4.18.0-372.9.1.el8
bpftool AlmaLinux 8 4.18.0-372.9.1.el8
kernel-core AlmaLinux 8 4.18.0-372.9.1.el8
kernel-tools AlmaLinux 8 4.18.0-372.9.1.el8
python3-perf AlmaLinux 8 4.18.0-372.9.1.el8
kernel-modules AlmaLinux 8 4.18.0-372.9.1.el8
kernel-debug-core AlmaLinux 8 4.18.0-372.9.1.el8

almalinux advisories ALSA-2022:1988

kernel Rocky Linux 8 4.18.0-372.9.1.el8
kernel-rt Rocky Linux 8 4.18.0-372.9.1.rt7.166.el8

rocky linux advisories RLSA-2022:1988 RLSA-2022:1975

Is CVE-2021-4037 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-4037 updated 2026-11-07 cvss 4.4

kernel: security regression for CVE-2018-13405

Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-372.9.1.el8, kernel 4.18.0-372.9.1.el8, bpftool 4.18.0-372.9.1.el8, kernel-core 4.18.0-372.9.1.el8, kernel-tools 4.18.0-372.9.1.el8, python3-perf 4.18.0-372.9.1.el8, +15 more
fixed: vendor fix RHSA-2022:1988
Red Hat Enterprise Linux BaseOS EUS (v.8.4) perf 4.18.0-305.49.1.el8_4, kernel 4.18.0-305.49.1.el8_4, bpftool 4.18.0-305.49.1.el8_4, kernel-core 4.18.0-305.49.1.el8_4, kernel-tools 4.18.0-305.49.1.el8_4, python3-perf 4.18.0-305.49.1.el8_4, +15 more
fixed: vendor fix RHSA-2022:4829
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-372.9.1.el8, kernel-debuginfo-common-aarch64 4.18.0-372.9.1.el8, kernel-debuginfo-common-ppc64le 4.18.0-372.9.1.el8
fixed: vendor fix RHSA-2022:1988
Red Hat Enterprise Linux CRB EUS (v.8.4) kernel-debuginfo-common-x86_64 4.18.0-305.49.1.el8_4, kernel-debuginfo-common-aarch64 4.18.0-305.49.1.el8_4, kernel-debuginfo-common-ppc64le 4.18.0-305.49.1.el8_4
fixed: vendor fix RHSA-2022:4829
Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-372.9.1.rt7.166.el8, kernel-rt-kvm 4.18.0-372.9.1.rt7.166.el8, kernel-rt-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-kvm 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-core 4.18.0-372.9.1.rt7.166.el8, +4 more
fixed: vendor fix RHSA-2022:1975
Red Hat Enterprise Linux NFV EUS (v.8.4) kernel-rt 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-kvm 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-core 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-modules 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-debug-kvm 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-debug-core 4.18.0-305.49.1.rt7.121.el8_4, +4 more
fixed: vendor fix RHSA-2022:4835
Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-372.9.1.rt7.166.el8, kernel-rt-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules-extra 4.18.0-372.9.1.rt7.166.el8, +2 more
fixed: vendor fix RHSA-2022:1975
Red Hat Enterprise Linux RT EUS (v.8.4) kernel-rt 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-core 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-modules 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-debug-core 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-debug-modules 4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-modules-extra 4.18.0-305.49.1.rt7.121.el8_4, +2 more
fixed: vendor fix RHSA-2022:4835

show 1 more

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-166-11 updated 2024-04-09 cvss 7.8

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem <V1.1
affected: fixed in V1.1, workaround support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-046-11 updated 2024-02-13 cvss 7.8

Siemens SCALANCE XCM-/XRM-300

Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4

+5 more productsfewer

Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4

affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux kernel
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 9
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Weakness

CWE-284 Improper Access Control

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
mailing-list, patch, vendor-advisory
git.kernel.org /pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
mailing-list, patch, vendor-advisory
access.redhat.com /errata/RHSA-2022:1975
vendor-advisory
access.redhat.com /errata/RHSA-2022:1988
vendor-advisory
access.redhat.com /errata/RHSA-2022:4829
vendor-advisory
access.redhat.com /errata/RHSA-2022:4835
vendor-advisory
debian.org /security/2022/dsa-5257
vendor-advisory, third-party-advisory
access.redhat.com /security/cve/CVE-2021-4037
vdb-entry, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=2027239
issue-tracking, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=2004810
issue-tracking, permissions-required, third-party-advisory
lists.debian.org /debian-lts-announce/2022/11/msg00001.html
mailing-list, third-party-advisory
cert-portal.siemens.com /productcert/html/ssa-794697.html
cert-portal.siemens.com /productcert/html/ssa-806742.html

Sources

CVE List CVE-2021-4037
NVD CVE-2021-4037

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed