github - ghsa-pwwc-8qxc-5w7f

ghsa-pwwc-8qxc-5w7f

Vulnerability from github

Published

2024-02-27 21:31

Modified

2024-08-01 15:31

Severity ?

8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: Avoid potential use after free in MHI send

It is possible that the MHI ul_callback will be invoked immediately following the queueing of the skb for transmission, leading to the callback decrementing the refcount of the associated sk and freeing the skb.

As such the dereference of skb and the increment of the sk refcount must happen before the skb is queued, to avoid the skb to be used after free and potentially the sk to drop its last refcount..

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-46973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-27T19:04:07Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Avoid potential use after free in MHI send\n\nIt is possible that the MHI ul_callback will be invoked immediately\nfollowing the queueing of the skb for transmission, leading to the\ncallback decrementing the refcount of the associated sk and freeing the\nskb.\n\nAs such the dereference of skb and the increment of the sk refcount must\nhappen before the skb is queued, to avoid the skb to be used after free\nand potentially the sk to drop its last refcount..",
  "id": "GHSA-pwwc-8qxc-5w7f",
  "modified": "2024-08-01T15:31:28Z",
  "published": "2024-02-27T21:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46973"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2021-46973

Vulnerability from cvelistv5

Published

2024-02-27 18:47

Modified

2024-11-04 11:56

Severity ?

8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

net: qrtr: Avoid potential use after free in MHI send

References

▼	URL	Tags
	https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80
	https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0
	https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40
	https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a

Impacted products

Vendor

Product

Version

▼

Linux

Version: 6e728f321393
Version: 6e728f321393
Version: 6e728f321393
Version: 6e728f321393

Linux

Version: 5.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "48ec949ac979",
                "status": "affected",
                "version": "6e728f321393",
                "versionType": "git"
              },
              {
                "lessThan": "ea474054c2cc",
                "status": "affected",
                "version": "6e728f321393",
                "versionType": "git"
              },
              {
                "lessThanOrEqual": "03c649dee8b1",
                "status": "affected",
                "version": "6e728f321393",
                "versionType": "git"
              },
              {
                "lessThan": "47a017f33943",
                "status": "affected",
                "version": "6e728f321393",
                "versionType": "git"
              },
              {
                "status": "affected",
                "version": "5.8"
              },
              {
                "lessThan": "5.8",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.11",
                "status": "unaffected",
                "version": "5.10.35",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.12",
                "status": "unaffected",
                "version": "5.11.19",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.13",
                "status": "unaffected",
                "version": "5.12.2",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "5.13",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-46973",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-28T18:49:05.463431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-25T15:54:16.377Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/mhi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48ec949ac979",
              "status": "affected",
              "version": "6e728f321393",
              "versionType": "git"
            },
            {
              "lessThan": "ea474054c2cc",
              "status": "affected",
              "version": "6e728f321393",
              "versionType": "git"
            },
            {
              "lessThan": "03c649dee8b1",
              "status": "affected",
              "version": "6e728f321393",
              "versionType": "git"
            },
            {
              "lessThan": "47a017f33943",
              "status": "affected",
              "version": "6e728f321393",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/mhi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Avoid potential use after free in MHI send\n\nIt is possible that the MHI ul_callback will be invoked immediately\nfollowing the queueing of the skb for transmission, leading to the\ncallback decrementing the refcount of the associated sk and freeing the\nskb.\n\nAs such the dereference of skb and the increment of the sk refcount must\nhappen before the skb is queued, to avoid the skb to be used after free\nand potentially the sk to drop its last refcount.."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T11:56:56.833Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"
        },
        {
          "url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a"
        }
      ],
      "title": "net: qrtr: Avoid potential use after free in MHI send",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46973",
    "datePublished": "2024-02-27T18:47:07.880Z",
    "dateReserved": "2024-02-27T18:42:55.944Z",
    "dateUpdated": "2024-11-04T11:56:56.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted