{"id":"CVE-2021-4037","revision":"effb351e4c804f0294f0b446d4fb3581","records":[{"revision":"effb351e4c804f0294f0b446d4fb3581","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2021-4037","aliases":[],"title":"Kernel: security regression for cve-2018-13405","description":"A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not.  This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.","state":0,"publishedAt":"2022-08-24T00:00:00+00:00","modifiedAt":"2026-10-14T10:04:01.692+00:00","affected":[{"ecosystem":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/","name":"kernel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Linux\",\n                    \"product\": \"kernel\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"*\",\n                            \"lessThan\": \"5.4.241\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.5\",\n                            \"lessThan\": \"5.10.146\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"5.12\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageName\": \"kernel\",\n                    \"collectionURL\": \"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/\",\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kernel-rt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kernel-rt\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.18.0-372.9.1.rt7.166.el8\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8::nfv\",\n                        \"cpe:/a:redhat:enterprise_linux:8::realtime\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kernel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kernel\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.18.0-372.9.1.el8\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8::crb\",\n                        \"cpe:/o:redhat:enterprise_linux:8::baseos\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kernel-rt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8.4 Extended Update Support\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kernel-rt\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.18.0-305.49.1.rt7.121.el8_4\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:rhel_eus:8.4::nfv\",\n                        \"cpe:/a:redhat:rhel_eus:8.4::realtime\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kernel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8.4 Extended Update Support\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kernel\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.18.0-305.49.1.el8_4\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:rhel_eus:8.4::crb\",\n                        \"cpe:/o:redhat:rhel_eus:8.4::baseos\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kernel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 6\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kernel\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:6\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kernel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kernel\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kernel-rt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kernel-rt\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kernel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kernel\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:9\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.4,"severity":"MEDIUM"}],"references":["https://access.redhat.com/errata/RHSA-2022:1975","https://access.redhat.com/errata/RHSA-2022:1988","https://access.redhat.com/errata/RHSA-2022:4829","https://access.redhat.com/errata/RHSA-2022:4835","https://access.redhat.com/security/cve/CVE-2021-4037","https://bugzilla.redhat.com/show_bug.cgi?id=2027239","https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e","https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-4037","license":"CVE Program Terms of Use","key":"cve-program:CVE-2021-4037","identifiers":["CVE-2021-4037"]},"retained":false,"historicalAffected":[]}],"coverage":[]}