ghsa-7xj5-h6cr-5xf4
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
hamradio: defer ax25 kfree after unregister_netdev
There is a possible race condition (use-after-free) like below
(USE) | (FREE) ax25_sendmsg | ax25_queue_xmit | dev_queue_xmit | __dev_queue_xmit | __dev_xmit_skb | sch_direct_xmit | ... xmit_one | netdev_start_xmit | tty_ldisc_kill __netdev_start_xmit | mkiss_close ax_xmit | kfree ax_encaps | |
Even though there are two synchronization primitives before the kfree: 1. wait_for_completion(&ax->dead). This can prevent the race with routines from mkiss_ioctl. However, it cannot stop the routine coming from upper layer, i.e., the ax25_sendmsg.
- netif_stop_queue(ax->dev). It seems that this line of code aims to halt the transmit queue but it fails to stop the routine that already being xmit.
This patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine.
{
"affected": [],
"aliases": [
"CVE-2021-47084"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-04T18:15:07Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhamradio: defer ax25 kfree after unregister_netdev\n\nThere is a possible race condition (use-after-free) like below\n\n (USE) | (FREE)\nax25_sendmsg |\n ax25_queue_xmit |\n dev_queue_xmit |\n __dev_queue_xmit |\n __dev_xmit_skb |\n sch_direct_xmit | ...\n xmit_one |\n netdev_start_xmit | tty_ldisc_kill\n __netdev_start_xmit | mkiss_close\n ax_xmit | kfree\n ax_encaps |\n |\n\nEven though there are two synchronization primitives before the kfree:\n1. wait_for_completion(\u0026ax-\u003edead). This can prevent the race with\nroutines from mkiss_ioctl. However, it cannot stop the routine coming\nfrom upper layer, i.e., the ax25_sendmsg.\n\n2. netif_stop_queue(ax-\u003edev). It seems that this line of code aims to\nhalt the transmit queue but it fails to stop the routine that already\nbeing xmit.\n\nThis patch reorder the kfree after the unregister_netdev to avoid the\npossible UAF as the unregister_netdev() is well synchronized and won\u0027t\nreturn if there is a running routine.",
"id": "GHSA-7xj5-h6cr-5xf4",
"modified": "2024-03-04T18:30:37Z",
"published": "2024-03-04T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47084"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3e0588c291d6ce225f2b891753ca41d45ba42469"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/450121075a6a6f1d50f97225d3396315309d61a1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/896193a02a2981e60c40d4614fd095ce92135ccd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8a1a314965a17c62084a056b4f2cb7a770854c90"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b5b193d0c67180fefdc664650138e3b7959df615"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cb6c99aedd2c843056a598a8907a6128cb07603b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eaa816a86e629cbcc0a94f38391fee09231628c7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ef5f7bfa19e3fc366f4c6d1a841ceaddf7a9f5d4"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.