CVE-2021-28691
published 2021-06-29CVE-2021-28691: Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.36%
28.4th percentile
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.46-1 (bookworm) | linux 5.10.46-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 2ac061ce97f413bfbbdd768f7d2e0fda2e8170df < 6b53db8c4c14b4e7256f058d202908b54a7b85b4 | 6b53db8c4c14b4e7256f058d202908b54a7b85b4 |
| linux | linux | >= 2ac061ce97f413bfbbdd768f7d2e0fda2e8170df < caec9bcaeb1a5f03f2d406305355c853af10c13e | caec9bcaeb1a5f03f2d406305355c853af10c13e |
| linux | linux | >= 2ac061ce97f413bfbbdd768f7d2e0fda2e8170df < 107866a8eb0b664675a260f1ba0655010fac1e08 | 107866a8eb0b664675a260f1ba0655010fac1e08 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 5.11 < 5.12.10 | 5.12.10 |
| linux | linux_kernel | >= 5.5 < 5.10.43 | 5.10.43 |
| linux | linux_kernel | >= 5.5.0 < 5.12.2 | 5.12.2 |
| msrc | cbl2_kernel_5.10.78.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_kernel_5.10.60.1-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: xen-netback: take a reference to the RX task thread
vendor_redhat·2024-03-15·CVSS 7.8
CVE-2021-47111 [HIGH] CWE-416 kernel: xen-netback: take a reference to the RX task thread
kernel: xen-netback: take a reference to the RX task thread
In the Linux kernel, the following vulnerability has been resolved:
xen-netback: take a reference to the RX task thread
Do this in order to prevent the task from being freed if the thread
returns (which can be triggered by the frontend) before the call to
kthread_stop done as part of the backend tear down. Not taking the
reference will lead to a use-after-free in that scenario. Such
reference was taken before but dropped as part of the rework done in
2ac061ce97f4.
Reintroduce the reference taking and add a comment this time
explaining why it's needed.
This is XSA-374 / CVE-2021-28691.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package:
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-08-24·CVSS 4.2
CVE-2021-38208 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly perform access control. An authenticated attacker could possibly
use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)
Michael Brown discovered that the Xen netback driver in the Linux kernel
did not properly handle malformed packets from a network PV frontend,
leading to a use-after-free vulnerability. An attacker in a guest VM could
use this to cause a denial of service or possibly execute arbitrary code.
(CVE-2021-28691)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device initialization failure, leading to a double-free
vulnerabilit
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-08-18·CVSS 4.2
CVE-2021-0129 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly perform access control. An authenticated attacker could possibly
use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)
Michael Brown discovered that the Xen netback driver in the Linux kernel
did not properly handle malformed packets from a network PV frontend,
leading to a use-after-free vulnerability. An attacker in a guest VM could
use this to cause a denial of service or possibly execute arbitrary code.
(CVE-2021-28691)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device initialization failure, leading to a double-free
vulnerabilit
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2021-07-20·CVSS 7.8
CVE-2021-33909 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the virtual file system implementation in the Linux
kernel contained an unsigned to signed integer conversion error. A local
attacker could use this to cause a denial of service (system crash) or
execute arbitrary code. (CVE-2021-33909)
Michael Brown discovered that the Xen netback driver in the Linux kernel
did not properly handle malformed packets from a network PV frontend,
leading to a use-after-free vulnerability. An attacker in a guest VM could
use this to cause a denial of service or possibly execute arbitrary code.
(CVE-2021-28691)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device initialization fai
Microsoft
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with qu
vendor_msrc·2021-06-08·CVSS 7.8
CVE-2021-28691 [HIGH] CWE-416 Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with qu
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos
Debian
CVE-2021-28691: linux - Guest triggered use-after-free in Linux xen-netback A malicious or buggy network...
vendor_debian·2021·CVSS 7.8
CVE-2021-28691 [HIGH] CVE-2021-28691: linux - Guest triggered use-after-free in Linux xen-netback A malicious or buggy network...
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
Scope: local
bookworm: resolved (fixed in 5.10.46-1)
bullseye: resolved (fixed in 5.10.46-1)
forky: resolved (fixed in 5.10.46-1)
sid: resolved (fixed in 5.10.46-1)
trixie: resolved (fixed in 5.10.46-1)
Debian
CVE-2021-47111: linux - In the Linux kernel, the following vulnerability has been resolved: xen-netback...
vendor_debian·2021·CVSS 7.8
CVE-2021-47111 [HIGH] CVE-2021-47111: linux - In the Linux kernel, the following vulnerability has been resolved: xen-netback...
In the Linux kernel, the following vulnerability has been resolved: xen-netback: take a reference to the RX task thread Do this in order to prevent the task from being freed if the thread returns (which can be triggered by the frontend) before the call to kthread_stop done as part of the backend tear down. Not taking the reference will lead to a use-after-free in that scenario. Such reference was taken before but dropped as part of the rework done in 2ac061ce97f4. Reintroduce the reference taking and add a comment this time explaining why it's needed. This is XSA-374 / CVE-2021-28691.
Scope: local
bookworm: resolved (fixed in 5.10.46-1)
bullseye: resolved (fixed in 5.10.46-1)
forky: resolved (fixed in 5.10.46-1)
sid: resolved (fixed in 5.10.46-1)
trixie: resolved (fixed in 5.10.46-1)
GHSA
GHSA-97vv-3jqh-r766: In the Linux kernel, the following vulnerability has been resolved:
xen-netback: take a reference to the RX task thread
Do this in order to prevent
ghsa_unreviewed·2024-03-15·CVSS 7.8
CVE-2021-47111 [HIGH] CWE-416 GHSA-97vv-3jqh-r766: In the Linux kernel, the following vulnerability has been resolved:
xen-netback: take a reference to the RX task thread
Do this in order to prevent
In the Linux kernel, the following vulnerability has been resolved:
xen-netback: take a reference to the RX task thread
Do this in order to prevent the task from being freed if the thread
returns (which can be triggered by the frontend) before the call to
kthread_stop done as part of the backend tear down. Not taking the
reference will lead to a use-after-free in that scenario. Such
reference was taken before but dropped as part of the rework done in
2ac061ce97f4.
Reintroduce the reference taking and add a comment this time
explaining why it's needed.
This is XSA-374 / CVE-2021-28691.
OSV
CVE-2021-47111: In the Linux kernel, the following vulnerability has been resolved: xen-netback: take a reference to the RX task thread Do this in order to prevent th
osv·2024-03-15·CVSS 7.8
CVE-2021-47111 [HIGH] CVE-2021-47111: In the Linux kernel, the following vulnerability has been resolved: xen-netback: take a reference to the RX task thread Do this in order to prevent th
In the Linux kernel, the following vulnerability has been resolved: xen-netback: take a reference to the RX task thread Do this in order to prevent the task from being freed if the thread returns (which can be triggered by the frontend) before the call to kthread_stop done as part of the backend tear down. Not taking the reference will lead to a use-after-free in that scenario. Such reference was taken before but dropped as part of the rework done in 2ac061ce97f4. Reintroduce the reference taking and add a comment this time explaining why it's needed. This is XSA-374 / CVE-2021-28691.
GHSA
GHSA-5gvc-4qph-j93r: Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and term
ghsa_unreviewed·2022-05-24
CVE-2021-28691 [HIGH] CWE-416 GHSA-5gvc-4qph-j93r: Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and term
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
OSV
linux-aws-5.8, linux-azure-5.8, linux-gcp-5.8, linux-oracle-5.8 vulnerabilities
osv·2021-08-24·CVSS 4.2
CVE-2020-26558 [MEDIUM] linux-aws-5.8, linux-azure-5.8, linux-gcp-5.8, linux-oracle-5.8 vulnerabilities
linux-aws-5.8, linux-azure-5.8, linux-gcp-5.8, linux-oracle-5.8 vulnerabilities
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly perform access control. An authenticated attacker could possibly
use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)
Michael Brown discovered that the Xen netback driver in the Linux kernel
did not properly handle malformed packets from a network PV frontend,
leading to a use-after-free vulnerability. An attacker in a guest VM could
use this to cause a denial of service or possibly execute arbitrary code.
(CVE-2021-28691)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device initialization failure, leading to a double-free
vulnerability. An attacker could u
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.11, linux-kvm, linux-oracle, linux-raspi vulnerabilities
osv·2021-08-18·CVSS 4.2
CVE-2020-26558 [MEDIUM] linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.11, linux-kvm, linux-oracle, linux-raspi vulnerabilities
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.11, linux-kvm, linux-oracle, linux-raspi vulnerabilities
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly perform access control. An authenticated attacker could possibly
use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)
Michael Brown discovered that the Xen netback driver in the Linux kernel
did not properly handle malformed packets from a network PV frontend,
leading to a use-after-free vulnerability. An attacker in a guest VM could
use this to cause a denial of service or possibly execute arbitrary code.
(CVE-2021-28691)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device initialization failure, leading to a double-free
vul
OSV
linux-oem-5.10 vulnerabilities
osv·2021-07-20·CVSS 7.8
CVE-2021-33909 [HIGH] linux-oem-5.10 vulnerabilities
linux-oem-5.10 vulnerabilities
It was discovered that the virtual file system implementation in the Linux
kernel contained an unsigned to signed integer conversion error. A local
attacker could use this to cause a denial of service (system crash) or
execute arbitrary code. (CVE-2021-33909)
Michael Brown discovered that the Xen netback driver in the Linux kernel
did not properly handle malformed packets from a network PV frontend,
leading to a use-after-free vulnerability. An attacker in a guest VM could
use this to cause a denial of service or possibly execute arbitrary code.
(CVE-2021-28691)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device initialization failure, leading to a double-free
vulnerability. An attacker could use this to c
OSV
CVE-2021-28691: Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and term
osv·2021-06-29·CVSS 7.8
CVE-2021-28691 [HIGH] CVE-2021-28691: Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and term
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
Kernel
xen-netback: take a reference to the RX task thread
kernel_security·2021-06-07·CVSS 7.8
CVE-2021-28691 [HIGH] xen-netback: take a reference to the RX task thread
xen-netback: take a reference to the RX task thread
Do this in order to prevent the task from being freed if the thread
returns (which can be triggered by the frontend) before the call to
kthread_stop done as part of the backend tear down. Not taking the
reference will lead to a use-after-free in that scenario. Such
reference was taken before but dropped as part of the rework done in
2ac061ce97f4.
Reintroduce the reference taking and add a comment this time
explaining why it's needed.
This is XSA-374 / CVE-2021-28691.
Fixes: 2ac061ce97f4 ('xen/netback: cleanup init and deinit code')
Signed-off-by: Roger Pau Monné
Cc: [email protected]
Reviewed-by: Jan Beulich
Reviewed-by: Juergen Gross
Signed-off-by: Juergen Gross
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-29
Published