| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| netrom: Decrease sock refcount when sock timers expire |
| |
| Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use |
| sock timer API. It replaces mod_timer() by sk_reset_timer(), and |
| del_timer() by sk_stop_timer(). |
| |
| Function sk_reset_timer() will increase the refcount of sock if it is |
| called on an inactive timer, hence, in case the timer expires, we need to |
| decrease the refcount ourselves in the handler, otherwise, the sock |
| refcount will be unbalanced and the sock will never be freed. |
| |
| The Linux kernel CVE team has assigned CVE-2021-47294 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.4.173 with commit ce29e8a259de767f7210d346ad2b031cb8ab2732 and fixed in 4.4.277 with commit 853262355518cd1247515b74e83fabf038aa6c29 |
| Issue introduced in 4.9.155 with commit baa9e32336bf6d0d74a7c3486d2a27feaf57cd5f and fixed in 4.9.277 with commit a01634bf91f2b6c42583770eb6815fb6d1e251cf |
| Issue introduced in 4.14.98 with commit 0adf571fa34b27bd0b97b408cc0f0dc54b72f0eb and fixed in 4.14.241 with commit 48866fd5c361ea417ed24b43fc2a7dc2f5b060ef |
| Issue introduced in 4.19.20 with commit 2c6b572458a9127e8070df13fa7f115c29ab1d92 and fixed in 4.19.199 with commit 9619cc7d97c3aa8ed3cfd2b8678b74fb6d6c7950 |
| Issue introduced in 5.0 with commit 63346650c1a94a92be61a57416ac88c0a47c4327 and fixed in 5.4.136 with commit 25df44e90ff5959b5c24ad361b648504a7e39ef3 |
| Issue introduced in 5.0 with commit 63346650c1a94a92be61a57416ac88c0a47c4327 and fixed in 5.10.54 with commit 6811744bd0efb9e472cb15d066cdb460beb8cb8a |
| Issue introduced in 5.0 with commit 63346650c1a94a92be61a57416ac88c0a47c4327 and fixed in 5.13.6 with commit bc1660206c3723c37ed4d622ad81781f1e987250 |
| Issue introduced in 5.0 with commit 63346650c1a94a92be61a57416ac88c0a47c4327 and fixed in 5.14 with commit 517a16b1a88bdb6b530f48d5d153478b2552d9a8 |
| Issue introduced in 3.18.134 with commit f1d9a1f2ef6ff17293d21d5e6b80e04bea0cf508 |
| Issue introduced in 4.20.7 with commit 519e8a22a454b1f1baa3a151b184fe51bc18e178 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47294 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/netrom/nr_timer.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/853262355518cd1247515b74e83fabf038aa6c29 |
| https://git.kernel.org/stable/c/a01634bf91f2b6c42583770eb6815fb6d1e251cf |
| https://git.kernel.org/stable/c/48866fd5c361ea417ed24b43fc2a7dc2f5b060ef |
| https://git.kernel.org/stable/c/9619cc7d97c3aa8ed3cfd2b8678b74fb6d6c7950 |
| https://git.kernel.org/stable/c/25df44e90ff5959b5c24ad361b648504a7e39ef3 |
| https://git.kernel.org/stable/c/6811744bd0efb9e472cb15d066cdb460beb8cb8a |
| https://git.kernel.org/stable/c/bc1660206c3723c37ed4d622ad81781f1e987250 |
| https://git.kernel.org/stable/c/517a16b1a88bdb6b530f48d5d153478b2552d9a8 |
