Bug 1921958 (CVE-2021-3348)

Summary: CVE-2021-3348 kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, dhoward, dramseur, dvlasenk, fhrbata, hdegoede, hkrzesin, itamar, jarodwilson, jeremy, jforbes, jhunter, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, kmitts, kpatch-maint, lgoncalv, linville, masami256, mchehab, mgala, mlangsdo, nmurray, ptalbert, qzhao, rhandlin, rvrbovsk, security-response-team, steved, walters, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A use after free flaw in the Linux kernel network block device (NBD) subsystem was found in the way user calls an ioctl NBD_SET_SOCK at a certain point during device setup.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-11-09 15:31:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1921960, 1927246, 1927247, 1927255    
Bug Blocks: 1921962    

Description Pedro Sampaio 2021-01-28 23:52:15 UTC
A flaw was found in the Linux kernel. A race codition in nbd ioctl may lead to a use-after-free read in nbd_queue_rq causing a crash.

Upstream patch:




Comment 1 Pedro Sampaio 2021-01-28 23:54:27 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1921960]

Comment 4 Alex 2021-02-10 11:57:23 UTC

To mitigate this issue, prevent the module nbd from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.

Comment 8 Petr Matousek 2021-02-11 12:49:41 UTC

This flaw is rated as having a Moderate impact because in the default configuration, the issue can only be triggered by a privileged local user (with access to the nbd device).

Comment 9 Justin M. Forbes 2021-03-04 21:59:38 UTC
This was fixed for Fedora with the 5.10.13 stable kernel updates.

Comment 25 errata-xmlrpc 2021-11-09 17:21:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4140 https://access.redhat.com/errata/RHSA-2021:4140

Comment 26 errata-xmlrpc 2021-11-09 18:23:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4356 https://access.redhat.com/errata/RHSA-2021:4356