CVE-2021-47388
published 2024-05-21CVE-2021-47388: In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211, for…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
15.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac80211, for fragmentation we need
to copy the PN to the RX struct so we can later use it to do a
comparison, since commit bf30ca922a0c ("mac80211: check defrag
PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without
it being necessarily valid, so use-after-free could occur if it
was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results
in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.12-1 (bookworm) | linux 5.14.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 0f716b48ed25503e6961f4b5b40ece36f7e4ed26 < 3d5d629c99c468458022e9b381789de3595bf4dd | 3d5d629c99c468458022e9b381789de3595bf4dd |
| linux | linux | >= 4.14.235 < 4.14.249 | 4.14.249 |
| linux | linux | >= 4.19.193 < 4.19.209 | 4.19.209 |
| linux | linux | >= 4.4.271 < 4.4.286 | 4.4.286 |
| linux | linux | >= 4.9.271 < 4.9.285 | 4.9.285 |
| linux | linux | >= 5.10.42 < 5.10.71 | 5.10.71 |
| linux | linux | >= 5.12.9 < 5.13 | 5.13 |
| linux | linux | >= 5.4.124 < 5.4.151 | 5.4.151 |
| linux | linux | >= 608b0a2ae928a74a2f89e02227339dd79cdb63cf < 447d001b875d0e7f211c4ba004916028da994258 | 447d001b875d0e7f211c4ba004916028da994258 |
| linux | linux | >= a9b57952fed41556c950a92123086724eaf11919 < f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb | f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb |
| linux | linux | >= bf30ca922a0c0176007e074b0acc77ed345e9990 < 27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 | 27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 |
| linux | linux | >= bf30ca922a0c0176007e074b0acc77ed345e9990 < 94513069eb549737bcfc3d988d6ed4da948a2de8 | 94513069eb549737bcfc3d988d6ed4da948a2de8 |
| linux | linux | >= c8b3a6150dc8ac78d5fdd5fbdfc4806249ef8b2c < 50149e0866a82cef33e680ee68dc380a5bc75d32 | 50149e0866a82cef33e680ee68dc380a5bc75d32 |
| linux | linux | >= d0f613fe6de344dc17ba04a88921a2094c13d3fa < 31de381aef0ab1b342f62485118dc8a19363dc78 | 31de381aef0ab1b342f62485118dc8a19363dc78 |
| linux | linux | >= e64ea0597050157f926ac2ba9b478a44ee5be945 < 57de2dcb18742dc2860861c9f496da7d42b67da0 | 57de2dcb18742dc2860861c9f496da7d42b67da0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.84-1 | 5.10.84-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 4.14.235 < 4.14.249 | 4.14.249 |
| linux | linux_kernel | >= 4.19.193 < 4.19.209 | 4.19.209 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: mac80211: fix use-after-free in CCMP/GCMP RX
vendor_redhat·2024-05-21·CVSS 7.8
CVE-2021-47388 [HIGH] CWE-416 kernel: mac80211: fix use-after-free in CCMP/GCMP RX
kernel: mac80211: fix use-after-free in CCMP/GCMP RX
In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac80211, for fragmentation we need
to copy the PN to the RX struct so we can later use it to do a
comparison, since commit bf30ca922a0c ("mac80211: check defrag
PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without
it being necessarily valid, so use-after-free could occur if it
was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results
in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
A vulnerability was found in the Linux kernel’s mac80211 driver related to the h
Debian
CVE-2021-47388: linux - In the Linux kernel, the following vulnerability has been resolved: mac80211: f...
vendor_debian·2021·CVSS 7.8
CVE-2021-47388 [HIGH] CVE-2021-47388: linux - In the Linux kernel, the following vulnerability has been resolved: mac80211: f...
In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame"). Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame. Fix this by reloading the variable after the code that results in the reallocations, if any. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
Scope: local
bookworm: resolved (fixed in 5.14.12-1)
bullseye: resolved (fixed in 5.10.84-1)
forky: resolved (fixed in 5.14.12-1)
sid:
GHSA
GHSA-q44p-8h6w-57m6: In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac8021
ghsa_unreviewed·2024-05-21
CVE-2021-47388 [HIGH] CWE-416 GHSA-q44p-8h6w-57m6: In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac8021
In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac80211, for fragmentation we need
to copy the PN to the RX struct so we can later use it to do a
comparison, since commit bf30ca922a0c ("mac80211: check defrag
PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without
it being necessarily valid, so use-after-free could occur if it
was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results
in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
OSV
CVE-2021-47388: In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211,
osv·2024-05-21·CVSS 7.8
CVE-2021-47388 [HIGH] CVE-2021-47388: In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211,
In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame"). Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame. Fix this by reloading the variable after the code that results in the reallocations, if any. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4ddhttps://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbbhttps://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4ddhttps://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb
2024-05-21
Published