Bug 1921958 (CVE-2021-3348) - CVE-2021-3348 kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
Summary: CVE-2021-3348 kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3348
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1921960 1927246 1927247 1927255
Blocks: 1921962
TreeView+ depends on / blocked
 
Reported: 2021-01-28 23:52 UTC by Pedro Sampaio
Modified: 2022-04-17 21:07 UTC (History)
47 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A use after free flaw in the Linux kernel network block device (NBD) subsystem was found in the way user calls an ioctl NBD_SET_SOCK at a certain point during device setup.
Clone Of:
Environment:
Last Closed: 2021-11-09 15:31:22 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4140 0 None None None 2021-11-09 17:21:38 UTC
Red Hat Product Errata RHSA-2021:4356 0 None None None 2021-11-09 18:23:39 UTC

Description Pedro Sampaio 2021-01-28 23:52:15 UTC 
A flaw was found in the Linux kernel. A race codition in nbd ioctl may lead to a use-after-free read in nbd_queue_rq causing a crash.

Upstream patch:

https://lore.kernel.org/linux-block/24dff677353e2e30a71d8b66c4dffdbdf77c4dbd.1611595239.git.josef@toxicpanda.com/

References:

https://www.openwall.com/lists/oss-security/2021/01/28/3
Comment 1 Pedro Sampaio 2021-01-28 23:54:27 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1921960]
Comment 3 Alex 2021-02-10 11:57:15 UTC 
External References:

https://lore.kernel.org/linux-block/24dff677353e2e30a71d8b66c4dffdbdf77c4dbd.1611595239.git.josef@toxicpanda.com/
Comment 4 Alex 2021-02-10 11:57:23 UTC 
Mitigation:

To mitigate this issue, prevent the module nbd from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.
Comment 8 Petr Matousek 2021-02-11 12:49:41 UTC 
Statement:

This flaw is rated as having a Moderate impact because in the default configuration, the issue can only be triggered by a privileged local user (with access to the nbd device).
Comment 9 Justin M. Forbes 2021-03-04 21:59:38 UTC 
This was fixed for Fedora with the 5.10.13 stable kernel updates.
Comment 25 errata-xmlrpc 2021-11-09 17:21:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4140 https://access.redhat.com/errata/RHSA-2021:4140
Comment 26 errata-xmlrpc 2021-11-09 18:23:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4356 https://access.redhat.com/errata/RHSA-2021:4356
Note You need to log in before you can comment on or make changes to this bug.