CVE-2021-3752

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-3752
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.9 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:A/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 5.5 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1999544 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html Mailing List Third Party Advisory
https://lore.kernel.org/lkml/20211115165435.133245729%40linuxfoundation.org/
https://security.netapp.com/advisory/ntap-20220318-0009/ Third Party Advisory
https://www.debian.org/security/2022/dsa-5096 Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/09/15/4 Exploit Mailing List Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1999544 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html Mailing List Third Party Advisory
https://lore.kernel.org/lkml/20211115165435.133245729%40linuxfoundation.org/
https://security.netapp.com/advisory/ntap-20220318-0009/ Third Party Advisory
https://www.debian.org/security/2022/dsa-5096 Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/09/15/4 Exploit Mailing List Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:3scale:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time:7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:7:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Configuration 11 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 12 (hide)

OR cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:*
History

21 Nov 2024, 06:22

Type Values Removed Values Added
References () https://bugzilla.redhat.com/show_bug.cgi?id=1999544 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=1999544 - Issue Tracking, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - Mailing List, Third Party Advisory
References () https://lore.kernel.org/lkml/20211115165435.133245729%40linuxfoundation.org/ - () https://lore.kernel.org/lkml/20211115165435.133245729%40linuxfoundation.org/ -
References () https://security.netapp.com/advisory/ntap-20220318-0009/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20220318-0009/ - Third Party Advisory
References () https://www.debian.org/security/2022/dsa-5096 - Third Party Advisory () https://www.debian.org/security/2022/dsa-5096 - Third Party Advisory
References () https://www.openwall.com/lists/oss-security/2021/09/15/4 - Exploit, Mailing List, Third Party Advisory () https://www.openwall.com/lists/oss-security/2021/09/15/4 - Exploit, Mailing List, Third Party Advisory
References () https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory

09 Nov 2023, 14:44

Type Values Removed Values Added
First Time Netapp h700e Firmware
Netapp h500e Firmware
Netapp h410c
Netapp h410s
Netapp h700s
Netapp h300e Firmware
Netapp h700s Firmware
Netapp h300e
Netapp h700e
Netapp h410s Firmware
Netapp h500e
Netapp h300s Firmware
Netapp h500s Firmware
Netapp h300s
Netapp h500s
Netapp h410c Firmware
CPE cpe:2.3:o:netapp:baseboard_management_controller_h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:baseboard_management_controller_h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:baseboard_management_controller_h300e:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:baseboard_management_controller_h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:baseboard_management_controller_h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:baseboard_management_controller_h410c:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:baseboard_management_controller_h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:baseboard_management_controller_h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:baseboard_management_controller_h700e:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:baseboard_management_controller_h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:baseboard_management_controller_h500e:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:baseboard_management_controller_h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:baseboard_management_controller_h300s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:baseboard_management_controller_h500s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:baseboard_management_controller_h700s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:baseboard_management_controller_h300e_firmware:-:*:*:*:*:*:*:*		 cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

07 Nov 2023, 03:38

Type Values Removed Values Added
References
  • {'url': 'https://lore.kernel.org/lkml/20211115165435.133245729@linuxfoundation.org/', 'name': 'https://lore.kernel.org/lkml/20211115165435.133245729@linuxfoundation.org/', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'MISC'}
  • () https://lore.kernel.org/lkml/20211115165435.133245729%40linuxfoundation.org/ -

26 Jun 2023, 18:56

Type Values Removed Values Added
CWE CWE-416 CWE-362
Information

Published : 2022-02-16 19:15

Updated : 2024-11-21 06:22

NVD link : CVE-2021-3752

Mitre link : CVE-2021-3752

CVE.ORG link : CVE-2021-3752

JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • virtualization_host
  • enterprise_linux_for_real_time_for_nfv
  • enterprise_linux_for_real_time
  • 3scale
  • enterprise_linux

netapp

  • h700e_firmware
  • h500s_firmware
  • h410c_firmware
  • h500s
  • h700s
  • h500e_firmware
  • h410c
  • h410s_firmware
  • h700e
  • h700s_firmware
  • h300s
  • h300e_firmware
  • h500e
  • h300s_firmware
  • h410s
  • h300e

fedoraproject

  • fedora

oracle

  • communications_cloud_native_core_network_exposure_function
  • communications_cloud_native_core_binding_support_function
  • communications_cloud_native_core_policy

linux

  • linux_kernel
CWE
CWE-416

Use After Free

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')