CVE-2021-3348
published 2021-02-01CVE-2021-3348: nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with…
PriorityP431high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.25%
16.6th percentile
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 5.10.13-1 (bookworm) | linux 5.10.13-1 (bookworm) |
| linux | linux_kernel | <= 5.10.12 | — |
| linux | linux_kernel | >= 0 < 5.10.13-1 | 5.10.13-1 |
| linux | linux_kernel | >= 0 < 5.10.13-1 | 5.10.13-1 |
| linux | linux_kernel | >= 0 < 5.10.13-1 | 5.10.13-1 |
| linux | linux_kernel | >= 0 < 5.10.13-1 | 5.10.13-1 |
| linux | linux_kernel | >= 0 < 4.15.0-141.145 | 4.15.0-141.145 |
| linux | linux_kernel | >= 0 < 5.4.0-71.79 | 5.4.0-71.79 |
| msrc | kernel-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-debuginfo-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-debuginfo-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-devel-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-devel-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-docs-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-docs-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-drivers-accessibility-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-drivers-accessibility-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-drivers-sound-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-drivers-sound-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-dtb-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-oprofile-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-tools-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-tools-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-04-13·CVSS 7.8
CVE-2021-26930 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Loris Reiff discovered that the BPF implementation in the Linux kernel did
not properly validate attributes in the getsockopt BPF hook. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2021-20194)
Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schönherr
discovered that the Xen paravirtualization backend in the Linux kernel did
not properly propagate errors to frontend drivers in some situations. An
attacker in a guest VM could possibly use this to cause a denial of service
(host domain crash). (CVE-2021-26930)
Jan Beulich discovered that multiple Xen backends in the Linux kernel did
not properly handle certain error conditions unde
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-04-13·CVSS 3.3
CVE-2021-20268 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ryota Shiga discovered that the sockopt BPF hooks in the Linux kernel could
allow a user space program to probe for valid kernel addresses. A local
attacker could use this to ease exploitation of another kernel
vulnerability. (CVE-2021-20239)
It was discovered that the BPF verifier in the Linux kernel did not
properly handle signed add32 and sub integer overflows. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-20268)
It was discovered that the priority inheritance futex implementation in the
Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this to caus
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-04-13·CVSS 5.5
CVE-2021-3347 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Wen Xu discovered that the xfs file system implementation in the Linux
kernel did not properly validate the number of extents in an inode. An
attacker could use this to construct a malicious xfs image that, when
mounted, could cause a denial of service (system crash). (CVE-2018-13095)
It was discovered that the priority inheritance futex implementation in the
Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-3347)
It was discovered that the network block device (nbd) driver in the Linux
kernel contained a use-after-free vulnerability
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2021-03-20·CVSS 7.8
CVE-2021-3348 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Loris Reiff discovered that the BPF implementation in the Linux kernel did
not properly validate attributes in the getsockopt BPF hook. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2021-20194)
It was discovered that the priority inheritance futex implementation in the
Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-3347)
It was discovered that the network block device (nbd) driver in the Linux
kernel contained a use-after-free vulnerability during device setup. A
local attacker wi
Microsoft
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O reque
vendor_msrc·2021-02-09·CVSS 7.0
CVE-2021-3348 [HIGH] CWE-362 nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O reque
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup aka CID-b98e762e3d71.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If
Red Hat
kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
vendor_redhat·2021-01-28·CVSS 7.0
CVE-2021-3348 [HIGH] CWE-362 kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
A use after free flaw in the Linux kernel network block device (NBD) subsystem was found in the way user calls an ioctl NBD_SET_SOCK at a certain point during device setup.
Statement: This flaw is rated as having a Moderate impact because in the default configuration, the issue can only be triggered by a privileged local user (with access to the nbd device).
Mitigation: To mitigate this issue, prevent the module nbd from being loaded. Please see https://access.re
Debian
CVE-2021-3348: linux - nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an...
vendor_debian·2021·CVSS 7.0
CVE-2021-3348 [HIGH] CVE-2021-3348: linux - nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an...
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
Scope: local
bookworm: resolved (fixed in 5.10.13-1)
bullseye: resolved (fixed in 5.10.13-1)
forky: resolved (fixed in 5.10.13-1)
sid: resolved (fixed in 5.10.13-1)
trixie: resolved (fixed in 5.10.13-1)
GHSA
GHSA-7hqh-xccf-8jp4: nbd_add_socket in drivers/block/nbd
ghsa_unreviewed·2022-05-24
CVE-2021-3348 [MEDIUM] CWE-362 GHSA-7hqh-xccf-8jp4: nbd_add_socket in drivers/block/nbd
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-ra
osv·2021-04-13·CVSS 7.8
CVE-2021-20194 [HIGH] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-ra
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
Loris Reiff discovered that the BPF implementation in the Linux kernel did
not properly validate attributes in the getsockopt BPF hook. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2021-20194)
Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schönherr
discovered that the Xen paravirtualization backend in the Linux kernel did
not properly propagate errors to frontend drivers in some situations. An
attacker in a guest VM could possibly use this to cause a denial of service
(host domain crash). (CVE-2
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2021-04-13·CVSS 5.5
CVE-2018-13095 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Wen Xu discovered that the xfs file system implementation in the Linux
kernel did not properly validate the number of extents in an inode. An
attacker could use this to construct a malicious xfs image that, when
mounted, could cause a denial of service (system crash). (CVE-2018-13095)
It was discovered that the priority inheritance futex implementation in the
Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-3347)
It was discovered that the network block dev
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
osv·2021-04-13·CVSS 3.3
CVE-2021-20239 [LOW] linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities
Ryota Shiga discovered that the sockopt BPF hooks in the Linux kernel could
allow a user space program to probe for valid kernel addresses. A local
attacker could use this to ease exploitation of another kernel
vulnerability. (CVE-2021-20239)
It was discovered that the BPF verifier in the Linux kernel did not
properly handle signed add32 and sub integer overflows. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-20268)
It was discovered that the priority inheritance futex implementation in the
Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this
OSV
linux-oem-5.10 vulnerabilities
osv·2021-03-20·CVSS 7.8
CVE-2021-20194 [HIGH] linux-oem-5.10 vulnerabilities
linux-oem-5.10 vulnerabilities
Loris Reiff discovered that the BPF implementation in the Linux kernel did
not properly validate attributes in the getsockopt BPF hook. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2021-20194)
It was discovered that the priority inheritance futex implementation in the
Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-3347)
It was discovered that the network block device (nbd) driver in the Linux
kernel contained a use-after-free vulnerability during device setup. A
local attacker with access to the nbd device could use this to cause a
denial of service (syst
OSV
CVE-2021-3348: nbd_add_socket in drivers/block/nbd
osv·2021-02-01·CVSS 7.0
CVE-2021-3348 [HIGH] CVE-2021-3348: nbd_add_socket in drivers/block/nbd
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2021/02/01/1https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b98e762e3d71e893b221f871825dc64694cfb258https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlhttps://www.openwall.com/lists/oss-security/2021/01/28/3http://www.openwall.com/lists/oss-security/2021/02/01/1https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b98e762e3d71e893b221f871825dc64694cfb258https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlhttps://www.openwall.com/lists/oss-security/2021/01/28/3
2021-02-01
Published