CVE-2021-47111 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: xen-netback: take a reference to the RX task thread Do this in order to prevent the task from being freed if the thread returns (which can be triggered by the frontend) before the call to kthread_stop done as part of the backend tear down. Not taking the reference will lead to a use-after-free in that scenario. Such reference was taken before but dropped as part of the rework done in 2ac061ce97f4. Reintroduce the reference taking and add a comment this time explaining why it's needed. This is XSA-374 / CVE-2021-28691.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08
https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4
https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e
https://lore.kernel.org/linux-cve-announce/2024031506-CVE-2021-47111-4bd0@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-47111
https://www.cve.org/CVERecord?id=CVE-2021-47111

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-03-15T20:14:19.898Z

Updated: 2024-11-04T11:59:37.342Z

Reserved: 2024-03-04T18:12:48.836Z

Link: CVE-2021-47111

Vulnrichment

Updated: 2024-08-04T05:24:39.854Z

NVD

Status : Awaiting Analysis

Published: 2024-03-15T21:15:06.577

Modified: 2024-03-17T22:38:29.433

Link: CVE-2021-47111

Redhat

Severity : Low

Publid Date: 2024-03-15T00:00:00Z

Links: CVE-2021-47111 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47111", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-04T18:12:48.836Z", "datePublished": "2024-03-15T20:14:19.898Z", "dateUpdated": "2024-11-04T11:59:37.342Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:59:37.342Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: take a reference to the RX task thread\n\nDo this in order to prevent the task from being freed if the thread\nreturns (which can be triggered by the frontend) before the call to\nkthread_stop done as part of the backend tear down. Not taking the\nreference will lead to a use-after-free in that scenario. Such\nreference was taken before but dropped as part of the rework done in\n2ac061ce97f4.\n\nReintroduce the reference taking and add a comment this time\nexplaining why it's needed.\n\nThis is XSA-374 / CVE-2021-28691."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netback/interface.c"], "versions": [{"version": "2ac061ce97f4", "lessThan": "6b53db8c4c14", "status": "affected", "versionType": "git"}, {"version": "2ac061ce97f4", "lessThan": "caec9bcaeb1a", "status": "affected", "versionType": "git"}, {"version": "2ac061ce97f4", "lessThan": "107866a8eb0b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netback/interface.c"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.43", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.10", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4"}, {"url": "https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e"}, {"url": "https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08"}], "title": "xen-netback: take a reference to the RX task thread", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-26T20:36:51.215407Z", "id": "CVE-2021-47111", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-26T20:36:58.053Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.854Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.854Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47111", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-26T20:36:51.215407Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-26T20:36:55.225Z"}}], "cna": {"title": "xen-netback: take a reference to the RX task thread", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2ac061ce97f4", "lessThan": "6b53db8c4c14", "versionType": "git"}, {"status": "affected", "version": "2ac061ce97f4", "lessThan": "caec9bcaeb1a", "versionType": "git"}, {"status": "affected", "version": "2ac061ce97f4", "lessThan": "107866a8eb0b", "versionType": "git"}], "programFiles": ["drivers/net/xen-netback/interface.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"status": "unaffected", "version": "0", "lessThan": "5.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.43", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.12.10", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/xen-netback/interface.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4"}, {"url": "https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e"}, {"url": "https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: take a reference to the RX task thread\n\nDo this in order to prevent the task from being freed if the thread\nreturns (which can be triggered by the frontend) before the call to\nkthread_stop done as part of the backend tear down. Not taking the\nreference will lead to a use-after-free in that scenario. Such\nreference was taken before but dropped as part of the rework done in\n2ac061ce97f4.\n\nReintroduce the reference taking and add a comment this time\nexplaining why it's needed.\n\nThis is XSA-374 / CVE-2021-28691."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:59:37.342Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47111", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:59:37.342Z", "dateReserved": "2024-03-04T18:12:48.836Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-15T20:14:19.898Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: xen-netback: take a reference to the RX task thread", "id": "2269871", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269871"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxen-netback: take a reference to the RX task thread\nDo this in order to prevent the task from being freed if the thread\nreturns (which can be triggered by the frontend) before the call to\nkthread_stop done as part of the backend tear down. Not taking the\nreference will lead to a use-after-free in that scenario. Such\nreference was taken before but dropped as part of the rework done in\n2ac061ce97f4.\nReintroduce the reference taking and add a comment this time\nexplaining why it's needed.\nThis is XSA-374 / CVE-2021-28691."], "name": "CVE-2021-47111", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47111\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47111\nhttps://lore.kernel.org/linux-cve-announce/2024031506-CVE-2021-47111-4bd0@gregkh/T/#u"], "threat_severity": "Low", "upstream_fix": "kernel 5.10.43, kernel 5.12.10, kernel 5.13"}