Bug 1921958 (CVE-2021-3348) - CVE-2021-3348 kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
Summary: CVE-2021-3348 kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
Alias: CVE-2021-3348
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1921960 1927246 1927247 1927255
Blocks: 1921962
TreeView+ depends on / blocked
Reported: 2021-01-28 23:52 UTC by Pedro Sampaio
Modified: 2022-04-17 21:07 UTC (History)
47 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A use after free flaw in the Linux kernel network block device (NBD) subsystem was found in the way user calls an ioctl NBD_SET_SOCK at a certain point during device setup.
Clone Of:
Last Closed: 2021-11-09 15:31:22 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4140 0 None None None 2021-11-09 17:21:38 UTC
Red Hat Product Errata RHSA-2021:4356 0 None None None 2021-11-09 18:23:39 UTC

Description Pedro Sampaio 2021-01-28 23:52:15 UTC
A flaw was found in the Linux kernel. A race codition in nbd ioctl may lead to a use-after-free read in nbd_queue_rq causing a crash.

Upstream patch:




Comment 1 Pedro Sampaio 2021-01-28 23:54:27 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1921960]

Comment 4 Alex 2021-02-10 11:57:23 UTC

To mitigate this issue, prevent the module nbd from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.

Comment 8 Petr Matousek 2021-02-11 12:49:41 UTC

This flaw is rated as having a Moderate impact because in the default configuration, the issue can only be triggered by a privileged local user (with access to the nbd device).

Comment 9 Justin M. Forbes 2021-03-04 21:59:38 UTC
This was fixed for Fedora with the 5.10.13 stable kernel updates.

Comment 25 errata-xmlrpc 2021-11-09 17:21:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4140 https://access.redhat.com/errata/RHSA-2021:4140

Comment 26 errata-xmlrpc 2021-11-09 18:23:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4356 https://access.redhat.com/errata/RHSA-2021:4356

Note You need to log in before you can comment on or make changes to this bug.