cbcvebase.
CVE-2021-3640
published 2022-03-03

CVE-2021-3640: A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way…

PriorityP434high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.37%
29.2th percentile
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debianlinux< linux 5.15.3-1 (bookworm)linux 5.15.3-1 (bookworm)
fedoraprojectfedora
linuxlinux_kernel< 4.4.2934.4.293
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.84-15.10.84-1
linuxlinux_kernel>= 0 < 5.15.3-15.15.3-1
linuxlinux_kernel>= 0 < 5.15.3-15.15.3-1
linuxlinux_kernel>= 0 < 5.15.3-15.15.3-1
linuxlinux_kernel>= 0 < 4.15.0-167.1754.15.0-167.175
linuxlinux_kernel>= 0 < 5.4.0-97.1105.4.0-97.110
linuxlinux_kernel>= 0 < 5.4.0-99.1125.4.0-99.112
linuxlinux_kernel>= 0 < 4.4.0-270.3044.4.0-270.304
linuxlinux_kernel>= 4.10 < 4.14.2564.14.256
linuxlinux_kernel>= 4.15 < 4.19.2184.19.218
linuxlinux_kernel>= 4.20 < 5.4.1605.4.160
linuxlinux_kernel>= 4.5 < 4.9.2914.9.291
linuxlinux_kernel>= 5.11 < 5.14.195.14.19
linuxlinux_kernel>= 5.15 < 5.15.35.15.3
linuxlinux_kernel>= 5.5.0 < 5.10.805.10.80

CVSS provenance

nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.4HIGH
vendor_ubuntu7.4HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.