LiveActive security incident?Get immediate response
CVE Record

CVE-2021-46971: perf/core: Fix unconditional security_locked_down() call

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix unconditional security_locked_down() call Currently, the lockdown state is queried unconditionally, even though its result is used only if the PERF_SAMPLE_REGS_INTR bit is set in attr.sample_type. While that doesn't matter in case of the Lockdown LSM, it causes trouble with the SELinux's lockdown hook implementation. SELinux implements the locked_down hook with a check whether the current task's type has the corresponding "lockdown" class permission ("integrity" or "confidentiality") allowed in the policy. This means that calling the hook when the access control decision would be ignored generates a bogus permission check and audit record. Fix this by checking sample_type first and only calling the hook when its result would be honored.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel perf issue where SELinux lockdown checks were triggered even when their result would not be used. The documented impact is bogus SELinux permission checks and audit records, not a confirmed system compromise path. No source in the bundle reports active exploitation.

Executive priority

Treat this as a low-priority kernel hygiene item unless audit integrity or SELinux lockdown operations are business-critical. There is no provided evidence of active exploitation or direct data compromise.

Technical view

The perf/core code called security_locked_down() unconditionally, although the result mattered only when attr.sample_type included PERF_SAMPLE_REGS_INTR. With SELinux lockdown hooks, that produced irrelevant lockdown permission decisions and audit records. Stable kernel commits change the order so sample_type is checked first.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions in the bundle, especially environments using SELinux lockdown policy and perf. The source bundle lists Linux 5.4 through 5.13-era versions, including 5.4.117, 5.10.35, 5.11.19, and 5.12.2.

Exploitation context

The bundle marks KEV as false and provides no public exploitation evidence. The described behavior is an erroneous security hook invocation and audit side effect, not a cited remote exploit or privilege escalation technique.

Researcher notes

The key condition is perf event configuration without PERF_SAMPLE_REGS_INTR still causing security_locked_down() to run. Validate through source or vendor patch state, not by developing offensive test cases. Evidence is limited to CVE text and kernel stable references.

Mitigation direction

  • Upgrade to a Linux kernel containing the referenced stable fix commits.
  • Check the distribution vendor advisory for backported kernel packages.
  • Review SELinux lockdown audit noise if affected kernels remain in use.
  • Prioritize normal kernel maintenance rather than emergency incident response.

Validation and detection

  • Inventory kernel versions across Linux hosts.
  • Check whether SELinux lockdown policy is used on those hosts.
  • Confirm vendor kernel packages include the stable perf/core fix.
  • Review audit logs for unexpected lockdown permission records tied to perf.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-46971 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb0c8fdc7fdb77586c3d1937050925b960743306e, b0c8fdc7fdb77586c3d1937050925b960743306e, b0c8fdc7fdb77586c3d1937050925b960743306e, b0c8fdc7fdb77586c3d1937050925b960743306e, b0c8fdc7fdb77586c3d1937050925b960743306eunaffected
LinuxLinux5.4, 0, 5.4.117, 5.10.35, 5.11.19, 5.12.2, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.