CVE-2021-46973

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-46973", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-27T18:42:55.944Z", "datePublished": "2024-02-27T18:47:07.880Z", "dateUpdated": "2026-08-05T08:45:19.247Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:19.247Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Avoid potential use after free in MHI send\n\nIt is possible that the MHI ul_callback will be invoked immediately\nfollowing the queueing of the skb for transmission, leading to the\ncallback decrementing the refcount of the associated sk and freeing the\nskb.\n\nAs such the dereference of skb and the increment of the sk refcount must\nhappen before the skb is queued, to avoid the skb to be used after free\nand potentially the sk to drop its last refcount.."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in qcom_mhi_qrtr_send, reached only when a local process sendmsg()s on an AF_QIPCRTR socket to a remote QRTR node backed by the MHI IPCR endpoint; it is not triggered by inbound network/modem frames alone.\nAC:L - An attacker fully controls the send side and can flood sends so the MHI UL completion tasklet runs on another CPU between mhi_queue_skb() and sock_hold(), making the race reliably hittable on SMP without conditions outside attacker influence.\nPR:L - qrtr_create() imposes no capability check, and ephemeral port bind/send requires only an unprivileged local account (CAP_NET_ADMIN is needed only for ports below the ephemeral range).\nUI:N - The attacker triggers the vulnerable send path with their own socket operations; no separate victim action is required.\nS:U - Impact is kernel memory corruption/privilege escalation within the same host kernel authority, with no VM/IOMMU/sandbox boundary crossed.\nC:H - The UAF lets the UL callback free the skb (and potentially the sk via an unbalanced sock_put) before sock_hold(skb->sk), enabling heap reuse and arbitrary read primitives per UAF guidance.\nI:H - The same skb/sk use-after-free is exploitable for heap spray and write/control-flow hijack primitives, so integrity impact is High.\nA:H - Dereferencing the freed skb or prematurely freeing the socket causes kernel oops/panic even without full exploitation, so availability impact is High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/qrtr/mhi.c"], "versions": [{"version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "lessThan": "48ec949ac979b4b42d740f67b6177797af834f80", "status": "affected", "versionType": "git"}, {"version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "lessThan": "ea474054c2cc6e1284604b21361f475c7cc8c0a0", "status": "affected", "versionType": "git"}, {"version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "lessThan": "03c649dee8b1eb5600212a249542a70f47a5ab40", "status": "affected", "versionType": "git"}, {"version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "lessThan": "47a017f33943278570c072bc71681809b2567b3a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/qrtr/mhi.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.35", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.11.19", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.2", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.11.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.12.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80"}, {"url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0"}, {"url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"}, {"url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a"}], "title": "net: qrtr: Avoid potential use after free in MHI send", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6e728f321393", "status": "affected", "lessThan": "48ec949ac979", "versionType": "git"}, {"version": "6e728f321393", "status": "affected", "lessThan": "ea474054c2cc", "versionType": "git"}, {"version": "6e728f321393", "status": "affected", "lessThanOrEqual": "03c649dee8b1", "versionType": "git"}, {"version": "6e728f321393", "status": "affected", "lessThan": "47a017f33943", "versionType": "git"}, {"version": "5.8", "status": "affected"}, {"version": "0", "status": "unaffected", "lessThan": "5.8", "versionType": "custom"}, {"version": "5.10.35", "status": "unaffected", "lessThanOrEqual": "5.11", "versionType": "custom"}, {"version": "5.11.19", "status": "unaffected", "lessThanOrEqual": "5.12", "versionType": "custom"}, {"version": "5.12.2", "status": "unaffected", "lessThanOrEqual": "5.13", "versionType": "custom"}, {"version": "5.13", "status": "unaffected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-02-28T18:49:05.463431Z", "id": "CVE-2021-46973", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T15:54:16.377Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.894Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.894Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-46973", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-28T18:49:05.463431Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "6e728f321393", "lessThan": "48ec949ac979", "versionType": "git"}, {"status": "affected", "version": "6e728f321393", "lessThan": "ea474054c2cc", "versionType": "git"}, {"status": "affected", "version": "6e728f321393", "versionType": "git", "lessThanOrEqual": "03c649dee8b1"}, {"status": "affected", "version": "6e728f321393", "lessThan": "47a017f33943", "versionType": "git"}, {"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "custom"}, {"status": "unaffected", "version": "5.10.35", "versionType": "custom", "lessThanOrEqual": "5.11"}, {"status": "unaffected", "version": "5.11.19", "versionType": "custom", "lessThanOrEqual": "5.12"}, {"status": "unaffected", "version": "5.12.2", "versionType": "custom", "lessThanOrEqual": "5.13"}, {"status": "unaffected", "version": "5.13", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T15:47:17.864Z"}}], "cna": {"title": "net: qrtr: Avoid potential use after free in MHI send", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in qcom_mhi_qrtr_send, reached only when a local process sendmsg()s on an AF_QIPCRTR socket to a remote QRTR node backed by the MHI IPCR endpoint; it is not triggered by inbound network/modem frames alone.\nAC:L - An attacker fully controls the send side and can flood sends so the MHI UL completion tasklet runs on another CPU between mhi_queue_skb() and sock_hold(), making the race reliably hittable on SMP without conditions outside attacker influence.\nPR:L - qrtr_create() imposes no capability check, and ephemeral port bind/send requires only an unprivileged local account (CAP_NET_ADMIN is needed only for ports below the ephemeral range).\nUI:N - The attacker triggers the vulnerable send path with their own socket operations; no separate victim action is required.\nS:U - Impact is kernel memory corruption/privilege escalation within the same host kernel authority, with no VM/IOMMU/sandbox boundary crossed.\nC:H - The UAF lets the UL callback free the skb (and potentially the sk via an unbalanced sock_put) before sock_hold(skb->sk), enabling heap reuse and arbitrary read primitives per UAF guidance.\nI:H - The same skb/sk use-after-free is exploitable for heap spray and write/control-flow hijack primitives, so integrity impact is High.\nA:H - Dereferencing the freed skb or prematurely freeing the socket causes kernel oops/panic even without full exploitation, so availability impact is High."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "lessThan": "48ec949ac979b4b42d740f67b6177797af834f80", "versionType": "git"}, {"status": "affected", "version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "lessThan": "ea474054c2cc6e1284604b21361f475c7cc8c0a0", "versionType": "git"}, {"status": "affected", "version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "lessThan": "03c649dee8b1eb5600212a249542a70f47a5ab40", "versionType": "git"}, {"status": "affected", "version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "lessThan": "47a017f33943278570c072bc71681809b2567b3a", "versionType": "git"}], "programFiles": ["net/qrtr/mhi.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.35", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.11.19", "versionType": "semver", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12.2", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/qrtr/mhi.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80"}, {"url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0"}, {"url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"}, {"url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Avoid potential use after free in MHI send\n\nIt is possible that the MHI ul_callback will be invoked immediately\nfollowing the queueing of the skb for transmission, leading to the\ncallback decrementing the refcount of the associated sk and freeing the\nskb.\n\nAs such the dereference of skb and the increment of the sk refcount must\nhappen before the skb is queued, to avoid the skb to be used after free\nand potentially the sk to drop its last refcount.."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.35", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.11.19", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.12.2", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.13", "versionStartIncluding": "5.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:19.247Z"}}}, "cveMetadata": {"cveId": "CVE-2021-46973", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:45:19.247Z", "dateReserved": "2024-02-27T18:42:55.944Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-27T18:47:07.880Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/qrtr/mhi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "48ec949ac979b4b42d740f67b6177797af834f80", "status": "affected", "version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "versionType": "git"}, {"lessThan": "ea474054c2cc6e1284604b21361f475c7cc8c0a0", "status": "affected", "version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "versionType": "git"}, {"lessThan": "03c649dee8b1eb5600212a249542a70f47a5ab40", "status": "affected", "version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "versionType": "git"}, {"lessThan": "47a017f33943278570c072bc71681809b2567b3a", "status": "affected", "version": "6e728f321393b1fce9e1c2c3e55f9f7c15991321", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/qrtr/mhi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.35", "versionType": "semver"}, {"lessThanOrEqual": "5.11.*", "status": "unaffected", "version": "5.11.19", "versionType": "semver"}, {"lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "48ec949ac979", "status": "affected", "version": "6e728f321393", "versionType": "git"}, {"lessThan": "ea474054c2cc", "status": "affected", "version": "6e728f321393", "versionType": "git"}, {"lessThanOrEqual": "03c649dee8b1", "status": "affected", "version": "6e728f321393", "versionType": "git"}, {"lessThan": "47a017f33943", "status": "affected", "version": "6e728f321393", "versionType": "git"}, {"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "5.11", "status": "unaffected", "version": "5.10.35", "versionType": "custom"}, {"lessThanOrEqual": "5.12", "status": "unaffected", "version": "5.11.19", "versionType": "custom"}, {"lessThanOrEqual": "5.13", "status": "unaffected", "version": "5.12.2", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F3F69BFB-4120-4A2B-83E8-A6BF45F67F46", "versionEndIncluding": " 5.10.35", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "353BACAE-C43D-4CEA-967C-C2B54A4CDA87", "versionEndIncluding": "5.11.19", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3F974DA-9544-4515-B734-9F45A5D3B761", "versionEndIncluding": "5.12.2", "versionStartIncluding": "5.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Avoid potential use after free in MHI send\n\nIt is possible that the MHI ul_callback will be invoked immediately\nfollowing the queueing of the skb for transmission, leading to the\ncallback decrementing the refcount of the associated sk and freeing the\nskb.\n\nAs such the dereference of skb and the increment of the sk refcount must\nhappen before the skb is queued, to avoid the skb to be used after free\nand potentially the sk to drop its last refcount.."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: qrtr: Evite el potencial use after free en el env\u00edo MHI. Es posible que MHI ul_callback se invoque inmediatamente despu\u00e9s de la puesta en cola del skb para la transmisi\u00f3n, lo que provocar\u00e1 que la devoluci\u00f3n de llamada disminuya el recuento del sk asociado y liberaci\u00f3n del skb. Como tal, la desreferencia de skb y el incremento del refcount de sk deben ocurrir antes de que el skb se ponga en cola, para evitar que el skb haga use after free y potencialmente que el sk elimine su \u00faltimo refcount."}], "id": "CVE-2021-46973", "lastModified": "2026-08-04T10:16:39.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-46973", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-02-28T18:49:05.463431Z", "version": "2.0.3"}}]}, "published": "2024-02-27T19:04:07.457", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net: qrtr: Avoid potential use after free in MHI send", "id": "2266828", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2266828"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: qrtr: Avoid potential use after free in MHI send\nIt is possible that the MHI ul_callback will be invoked immediately\nfollowing the queueing of the skb for transmission, leading to the\ncallback decrementing the refcount of the associated sk and freeing the\nskb.\nAs such the dereference of skb and the increment of the sk refcount must\nhappen before the skb is queued, to avoid the skb to be used after free\nand potentially the sk to drop its last refcount..", "A use-after-free flaw was found in the Linux kernel. This issue may lead to compromised availability."], "name": "CVE-2021-46973", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-46973\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-46973\nhttps://lore.kernel.org/linux-cve-announce/2024022721-CVE-2021-46973-20ce@gregkh/T/#u"], "threat_severity": "Moderate"}

{}