CVE-2021-46936
published 2024-02-27CVE-2021-46936: In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
15.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: fix use-after-free in tw_timer_handler
A real world panic issue was found as follow in Linux 5.4.
BUG: unable to handle page fault for address: ffffde49a863de28
PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0
RIP: 0010:tw_timer_handler+0x20/0x40
Call Trace:
call_timer_fn+0x2b/0x120
run_timer_softirq+0x1ef/0x450
__do_softirq+0x10d/0x2b8
irq_exit+0xc7/0xd0
smp_apic_timer_interrupt+0x68/0x120
apic_timer_interrupt+0xf/0x20
This issue was also reported since 2017 in the thread [1],
unfortunately, the issue was still can be reproduced after fixing
DCCP.
The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net
namespace is destroyed since tcp_sk_ops is registered befrore
ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops
in the list of pernet_list. There will be a use-after-free on
net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net
if there are some inflight time-wait timers.
This bug is not introduced by commit f2bf415cfed7 ("mib: add net to
NET_ADD_STATS_BH") since the net_statistics is a global variable
instead of dynamic allocation and freeing. Actually, commit
61a7e26028b9 ("mib: put net statistics on struct net") introduces
the bug since it put net statistics on struct net and free it when
net namespace is destroyed.
Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug
and replace pr_crit() with panic() since continuing is meaningless
when init_ipv4_mibs() fails.
[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.15.15-1 (bookworm) | linux 5.15.15-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 61a7e26028b94805fd686a6dc9dbd9941f8f19b0 < 15579e1301f856ad9385d720c9267c11032a5022 | 15579e1301f856ad9385d720c9267c11032a5022 |
| linux | linux | >= 61a7e26028b94805fd686a6dc9dbd9941f8f19b0 < e73164e89d1be561228a4534e1091369ee4ba41a | e73164e89d1be561228a4534e1091369ee4ba41a |
| linux | linux | >= 61a7e26028b94805fd686a6dc9dbd9941f8f19b0 < 5c2fe20ad37ff56070ae0acb34152333976929b4 | 5c2fe20ad37ff56070ae0acb34152333976929b4 |
| linux | linux | >= 61a7e26028b94805fd686a6dc9dbd9941f8f19b0 < a8e1944b44f94f5c5f530e434c5eaee787254566 | a8e1944b44f94f5c5f530e434c5eaee787254566 |
| linux | linux | >= 61a7e26028b94805fd686a6dc9dbd9941f8f19b0 < fe5838c22b986c1190f1dce9aa09bf6a491c1a69 | fe5838c22b986c1190f1dce9aa09bf6a491c1a69 |
| linux | linux | >= 61a7e26028b94805fd686a6dc9dbd9941f8f19b0 < 2386e81a1d277f540e1285565c9d41d531bb69d4 | 2386e81a1d277f540e1285565c9d41d531bb69d4 |
| linux | linux | >= 61a7e26028b94805fd686a6dc9dbd9941f8f19b0 < 08eacbd141e2495d2fcdde84358a06c4f95cbb13 | 08eacbd141e2495d2fcdde84358a06c4f95cbb13 |
| linux | linux | >= 61a7e26028b94805fd686a6dc9dbd9941f8f19b0 < e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 | e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 |
| linux | linux_kernel | >= 0 < 5.10.92-1 | 5.10.92-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 4.4.0-253.287 | 4.4.0-253.287 |
| linux | linux_kernel | >= 2.6.27 < 4.4.298 | 4.4.298 |
| linux | linux_kernel | >= 4.10.0 < 4.14.261 | 4.14.261 |
| linux | linux_kernel | >= 4.15.0 < 4.19.224 | 4.19.224 |
| linux | linux_kernel | >= 4.20.0 < 5.4.170 | 5.4.170 |
| linux | linux_kernel | >= 4.5.0 < 4.9.296 | 4.9.296 |
| linux | linux_kernel | >= 5.11.0 < 5.15.13 | 5.15.13 |
| linux | linux_kernel | >= 5.5.0 < 5.10.90 | 5.10.90 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-04-19·CVSS 7.0
CVE-2023-1382 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the instruction emulator
of the Linux kernel on Arm 64-bit systems. A local attacker could use this
to cause a denial of service (system crash). (CVE-2022-20422)
Wei Chen discovered that a race condition existed in the TIPC protocol
implementation in the Linux kernel, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-1382)
Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2
mitigations with prctl syscall were insufficient in some situations. A
local attacker could possibly use this to expose sensitive information.
(CVE-2023-1998)
Red Hat
kernel: net: fix use-after-free in tw_timer_handler
vendor_redhat·2024-02-27·CVSS 7.8
CVE-2021-46936 [HIGH] CWE-416 kernel: net: fix use-after-free in tw_timer_handler
kernel: net: fix use-after-free in tw_timer_handler
In the Linux kernel, the following vulnerability has been resolved:
net: fix use-after-free in tw_timer_handler
A real world panic issue was found as follow in Linux 5.4.
BUG: unable to handle page fault for address: ffffde49a863de28
PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0
RIP: 0010:tw_timer_handler+0x20/0x40
Call Trace:
call_timer_fn+0x2b/0x120
run_timer_softirq+0x1ef/0x450
__do_softirq+0x10d/0x2b8
irq_exit+0xc7/0xd0
smp_apic_timer_interrupt+0x68/0x120
apic_timer_interrupt+0xf/0x20
This issue was also reported since 2017 in the thread [1],
unfortunately, the issue was still can be reproduced after fixing
DCCP.
The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net
namespace is destroyed since tcp_
Debian
CVE-2021-46936: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix us...
vendor_debian·2021·CVSS 7.8
CVE-2021-46936 [HIGH] CVE-2021-46936: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix us...
In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0 RIP: 0010:tw_timer_handler+0x20/0x40 Call Trace: call_timer_fn+0x2b/0x120 run_timer_softirq+0x1ef/0x450 __do_softirq+0x10d/0x2b8 irq_exit+0xc7/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20 This issue was also reported since 2017 in the thread [1], unfortunately, the issue was still can be reproduced after fixing DCCP. The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net namespace is destroyed since tcp_sk_ops is registered befrore ipv4_mib_ops, which means
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2024-04-19·CVSS 7.0
CVE-2022-20422 [HIGH] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
It was discovered that a race condition existed in the instruction emulator
of the Linux kernel on Arm 64-bit systems. A local attacker could use this
to cause a denial of service (system crash). (CVE-2022-20422)
Wei Chen discovered that a race condition existed in the TIPC protocol
implementation in the Linux kernel, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-1382)
Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2
mitigations with prctl syscall were insufficient in some situations. A
local attacker could possibly use this to expose sensitive information.
(CVE-2023-1998)
Daniele Antonioli discovered that the
GHSA
GHSA-9x4x-qwhq-g8f7: In the Linux kernel, the following vulnerability has been resolved:
net: fix use-after-free in tw_timer_handler
A real world panic issue was found a
ghsa_unreviewed·2024-02-27
CVE-2021-46936 [HIGH] CWE-416 GHSA-9x4x-qwhq-g8f7: In the Linux kernel, the following vulnerability has been resolved:
net: fix use-after-free in tw_timer_handler
A real world panic issue was found a
In the Linux kernel, the following vulnerability has been resolved:
net: fix use-after-free in tw_timer_handler
A real world panic issue was found as follow in Linux 5.4.
BUG: unable to handle page fault for address: ffffde49a863de28
PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0
RIP: 0010:tw_timer_handler+0x20/0x40
Call Trace:
call_timer_fn+0x2b/0x120
run_timer_softirq+0x1ef/0x450
__do_softirq+0x10d/0x2b8
irq_exit+0xc7/0xd0
smp_apic_timer_interrupt+0x68/0x120
apic_timer_interrupt+0xf/0x20
This issue was also reported since 2017 in the thread [1],
unfortunately, the issue was still can be reproduced after fixing
DCCP.
The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net
namespace is destroyed since tcp_sk_ops is registered befrore
ipv4_mib_ops, which
OSV
CVE-2021-46936: In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as
osv·2024-02-27·CVSS 7.8
CVE-2021-46936 [HIGH] CVE-2021-46936: In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as
In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0 RIP: 0010:tw_timer_handler+0x20/0x40 Call Trace: call_timer_fn+0x2b/0x120 run_timer_softirq+0x1ef/0x450 __do_softirq+0x10d/0x2b8 irq_exit+0xc7/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20 This issue was also reported since 2017 in the thread [1], unfortunately, the issue was still can be reproduced after fixing DCCP. The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net namespace is destroyed since tcp_sk_ops is registered befrore ipv4_mib_ops, which means
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41ahttps://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41ahttps://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69
2024-02-27
Published