CVE-2021-20226
published 2021-02-23CVE-2021-20226: A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.44%
36.2th percentile
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.4-1 (bookworm) | linux 5.10.4-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.4-1 | 5.10.4-1 |
| linux | linux_kernel | >= 0 < 5.10.4-1 | 5.10.4-1 |
| linux | linux_kernel | >= 0 < 5.10.4-1 | 5.10.4-1 |
| linux | linux_kernel | >= 0 < 5.10.4-1 | 5.10.4-1 |
| linux | linux_kernel | >= 5.5 < 5.8.18 | 5.8.18 |
| linux | linux_kernel | >= 5.9.0 < 5.9.3 | 5.9.3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.1MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: use-after-free in io_uring feature
vendor_redhat·2021-02-04·CVSS 7.8
CVE-2021-20226 [HIGH] CWE-416 kernel: use-after-free in io_uring feature
kernel: use-after-free in io_uring feature
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system. The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the
Debian
CVE-2021-20226: linux - A use-after-free flaw was found in the io_uring in Linux kernel, where a local a...
vendor_debian·2021·CVSS 7.8
CVE-2021-20226 [HIGH] CVE-2021-20226: linux - A use-after-free flaw was found in the io_uring in Linux kernel, where a local a...
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
Scope: local
bookworm: resolved (fixed in 5.10.4-1)
bullseye: resolved (fixed in 5.10.4-1)
forky: resolved (fixed in 5.10.4-1)
sid: resolved (fixed in 5.10.4-1)
trixie: resolved (fixed in 5.10.4-1)
GHSA
GHSA-vwgf-gfhw-h447: A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem
ghsa_unreviewed·2022-05-24
CVE-2021-20226 [HIGH] CWE-416 GHSA-vwgf-gfhw-h447: A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
OSV
CVE-2021-20226: A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem
osv·2021-02-23·CVSS 7.8
CVE-2021-20226 [HIGH] CVE-2021-20226: A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
No detection rules found.
No public exploits indexed.
2021-02-23
Published