CVE-2021-47459

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47459
In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv It will trigger UAF for rx_kref of j1939_priv as following. cpu0 cpu1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start j1939_sk_bind(socket1, ndev0, ...) j1939_netdev_start j1939_priv_set j1939_priv_get_by_ndev_locked j1939_jsk_add ..... j1939_netdev_stop kref_put_lock(&priv->rx_kref, ...) kref_get(&priv->rx_kref, ...) REFCOUNT_WARN("addition on 0;...") ==================================================== refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP: 0010:refcount_warn_saturate+0x169/0x1e0 Call Trace: j1939_netdev_start+0x68b/0x920 j1939_sk_bind+0x426/0xeb0 ? security_socket_bind+0x83/0xb0 The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to protect.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f Patch
https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668 Patch
https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d Patch
https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586 Patch
https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f Patch
https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668 Patch
https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d Patch
https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*
History

14 Jan 2025, 17:32

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f - () https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f - Patch
References () https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668 - () https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668 - Patch
References () https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d - () https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d - Patch
References () https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586 - () https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586 - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 Nov 2024, 06:36

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: j1939: j1939_netdev_start(): arreglar UAF para rx_kref de j1939_priv Activará UAF para rx_kref de j1939_priv de la siguiente manera. cpu0 cpu1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start j1939_sk_bind(socket1, ndev0, ...) j1939_netdev_start j1939_priv_set j1939_priv_get_by_ndev_locked j1939_jsk_add ..... kref_put_lock(&priv->rx_kref, ...) kref_get(&priv->rx_kref , ...) REFCOUNT_WARN("adición en 0;...") ================================== ==================== refcount_t: suma en 0; use-after-free. ADVERTENCIA: CPU: 1 PID: 20874 en lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP: 0010:refcount_warn_saturate+0x169/0x1e0 Seguimiento de llamadas: j1939_netdev_start+0x68b/0x920 j1939_sk_bind+0x426 /0xeb0 ? security_socket_bind+0x83/0xb0 Los kref_get() y kref_put() de rx_kref deben usar j1939_netdev_lock para proteger.
References () https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f - () https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f -
References () https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668 - () https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668 -
References () https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d - () https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d -
References () https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586 - () https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586 -

22 May 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 07:15

Updated : 2025-01-14 17:32

NVD link : CVE-2021-47459

Mitre link : CVE-2021-47459

CVE.ORG link : CVE-2021-47459

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free