| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhamradio: defer ax25 kfree after unregister_netdev\n\nThere is a possible race condition (use-after-free) like below\n\n (USE) | (FREE)\nax25_sendmsg |\n ax25_queue_xmit |\n dev_queue_xmit |\n __dev_queue_xmit |\n __dev_xmit_skb |\n sch_direct_xmit | ...\n xmit_one |\n netdev_start_xmit | tty_ldisc_kill\n __netdev_start_xmit | mkiss_close\n ax_xmit | kfree\n ax_encaps |\n |\n\nEven though there are two synchronization primitives before the kfree:\n1. wait_for_completion(&ax->dead). This can prevent the race with\nroutines from mkiss_ioctl. However, it cannot stop the routine coming\nfrom upper layer, i.e., the ax25_sendmsg.\n\n2. netif_stop_queue(ax->dev). It seems that this line of code aims to\nhalt the transmit queue but it fails to stop the routine that already\nbeing xmit.\n\nThis patch reorder the kfree after the unregister_netdev to avoid the\npossible UAF as the unregister_netdev() is well synchronized and won't\nreturn if there is a running routine." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "versions": [ |
| { |
| "version": "1da177e4c3f4", |
| "lessThan": "b5b193d0c671", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1da177e4c3f4", |
| "lessThan": "8a1a314965a1", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1da177e4c3f4", |
| "lessThan": "eaa816a86e62", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1da177e4c3f4", |
| "lessThan": "896193a02a29", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1da177e4c3f4", |
| "lessThan": "ef5f7bfa19e3", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1da177e4c3f4", |
| "lessThan": "450121075a6a", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1da177e4c3f4", |
| "lessThan": "cb6c99aedd2c", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1da177e4c3f4", |
| "lessThan": "3e0588c291d6", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "versions": [ |
| { |
| "version": "4.4.297", |
| "lessThanOrEqual": "4.4.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "4.9.295", |
| "lessThanOrEqual": "4.9.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "4.14.260", |
| "lessThanOrEqual": "4.14.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "4.19.223", |
| "lessThanOrEqual": "4.19.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.4.169", |
| "lessThanOrEqual": "5.4.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.10.89", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.15.12", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.16", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/b5b193d0c67180fefdc664650138e3b7959df615" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/8a1a314965a17c62084a056b4f2cb7a770854c90" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/eaa816a86e629cbcc0a94f38391fee09231628c7" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/896193a02a2981e60c40d4614fd095ce92135ccd" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/ef5f7bfa19e3fc366f4c6d1a841ceaddf7a9f5d4" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/450121075a6a6f1d50f97225d3396315309d61a1" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/cb6c99aedd2c843056a598a8907a6128cb07603b" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/3e0588c291d6ce225f2b891753ca41d45ba42469" |
| } |
| ], |
| "title": "hamradio: defer ax25 kfree after unregister_netdev", |
| "x_generator": { |
| "engine": "bippy-4986f5686161" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2021-47084", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
