CVE-2021-3640
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.
- CVSS 3.1
- 7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362, CWE-416
- Affected
- linux/linux kernel · debian/debian linux · fedoraproject/fedora · canonical/ubuntu linux · netapp/h300s firmware · netapp/h700s firmware · netapp/h300e firmware · netapp/h500e firmware · netapp/h700e firmware · netapp/h410s firmware · netapp/h410c firmware · netapp/h500s firmware
- Source
- secalert@redhat.com
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1980646Issue Tracking, Patch, Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/bluetooth/sco.c?h=v5.16&id=99c23da0eed4fd20cae8243f2b51e10e66aa0951Patch, Vendor Advisory
- https://github.com/torvalds/linux/commit/99c23da0eed4fd20cae8243f2b51e10e66aa0951Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00011.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220419-0003/Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3640Patch, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5096Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/07/22/1Exploit, Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1980646Issue Tracking, Patch, Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/bluetooth/sco.c?h=v5.16&id=99c23da0eed4fd20cae8243f2b51e10e66aa0951Patch, Vendor Advisory
- https://github.com/torvalds/linux/commit/99c23da0eed4fd20cae8243f2b51e10e66aa0951Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00011.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220419-0003/Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3640Patch, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5096Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/07/22/1Exploit, Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.