Bug 1980646 (CVE-2021-3640)
| Summary: | CVE-2021-3640 kernel: use-after-free vulnerability in function sco_sock_sendmsg() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, adscvr, airlied, alciregi, allarkin, bhu, blc, bskeggs, chwhite, crwood, dahernan, dhoward, dvlasenk, fhrbata, gtiwari, hdegoede, hkrzesin, jarod, jarodwilson, jeremy, jfaracco, jforbes, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, security-response-team, steved, tyberry, walters, wcosta, williams |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-05 05:34:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1984638, 1984639, 1984640, 1984641, 1984642, 1984643, 1984957, 2066188, 2102097, 2103443 | ||
| Bug Blocks: | 1980647, 1980649 | ||
|
Description
Marian Rehak
2021-07-09 06:34:33 UTC
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1984957] Hello there, I asked the reporter via email. (sorry for the dealy, I was PTO last week) (In reply to Marian Rehak from comment #11) > Hello there, > I asked the reporter via email. (sorry for the dealy, I was PTO last week) Any update on this ? thanks Gopal In reply to comment #13: > > (In reply to Marian Rehak from comment #11) > > Hello there, > > I asked the reporter via email. (sorry for the dealy, I was PTO last week) > > Any update on this ? > > thanks > Gopal The patch is this one: https://lkml.org/lkml/2021/8/28/238 (but looks like not applied yet: https://lore.kernel.org/lkml/20211109010649.1191041-2-sashal@kernel.org/T/ ) This was fixed for Fedora with the 5.15.3 stable kernel updates. In reply to comment #14: > In reply to comment #13: > > > > (In reply to Marian Rehak from comment #11) > > > Hello there, > > > I asked the reporter via email. (sorry for the dealy, I was PTO last week) > > > > Any update on this ? > > > > thanks > > Gopal > > The patch is this one: > https://lkml.org/lkml/2021/8/28/238 > > (but looks like not applied yet: > https://lore.kernel.org/lkml/20211109010649.1191041-2-sashal@kernel.org/T/ > ) Additional patch that removed buggy code (simplifying the logic): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/bluetooth/sco.c?h=v5.16&id=0771cbb3b97d3c1d68eecd7f00055f599954c34e This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7444 https://access.redhat.com/errata/RHSA-2022:7444 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7683 https://access.redhat.com/errata/RHSA-2022:7683 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:7933 https://access.redhat.com/errata/RHSA-2022:7933 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8267 https://access.redhat.com/errata/RHSA-2022:8267 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-3640 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0724 https://access.redhat.com/errata/RHSA-2024:0724 |