Use-after-free in Linux kernel - CVE-2021-44733

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU59100

Use-after-free in Linux kernel - CVE-2021-44733

Published: December 28, 2021


Vulnerability identifier: #VU59100
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-44733
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local user to elevate privileges on the system.

The vulnerability exists due to a use-after-free error in the drivers/tee/tee_shm.c file within the TEE subsystem in the Linux kernel. A local user can trigger a race condition in tee_shm_get_from_id during an attempt to free a shared memory object and execute arbitrary code with elevated privileges.


Affected software

Linux kernel
Debian Linux
SUSE Linux Enterprise Micro
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
Ubuntu
SUSE Linux Enterprise Module for Realtime
Migration Toolkit for Containers
Red Hat Advanced Cluster Management for Kubernetes
IBM Spectrum Protect Plus
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.15.0-173-generic (Ubuntu package)
linux-image-4.15.0-173-lowlatency (Ubuntu package)
linux-image-4.15.0-173-generic-lpae (Ubuntu package)
linux-image-dell300x (Ubuntu package)
linux-image-4.15.0-1038-dell300x (Ubuntu package)
linux-image-4.15.0-1090-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1110-kvm (Ubuntu package)
linux-image-4.15.0-1119-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1123-snapdragon (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1124-aws (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1134-azure (Ubuntu package)
kernel-debug-modules-extra
kernel-doc
bpftool
kernel
kernel-core
kernel-cross-headers
kernel-debug
kernel-debug-core
kernel-debug-devel
kernel-debug-modules
kernel-devel
kernel-headers
kernel-modules
kernel-modules-extra
kernel-tools
kernel-tools-libs
perf
python3-perf
kernel-abi-stablelists
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux (Debian package)
ocfs2-kmp-rt
kernel-source-rt
kernel-devel-rt
ocfs2-kmp-rt-debuginfo
cluster-md-kmp-rt
cluster-md-kmp-rt-debuginfo
dlm-kmp-rt
dlm-kmp-rt-debuginfo
gfs2-kmp-rt
gfs2-kmp-rt-debuginfo
kernel-rt
kernel-rt-debuginfo
kernel-rt-debugsource
kernel-rt-devel
kernel-rt-devel-debuginfo
kernel-rt_debug
kernel-rt_debug-debuginfo
kernel-rt_debug-debugsource
kernel-rt_debug-devel
kernel-rt_debug-devel-debuginfo
kernel-syms-rt
linux-image-oem (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-105-generic-lpae (Ubuntu package)
linux-image-5.4.0-105-lowlatency (Ubuntu package)
linux-image-5.4.0-105-generic (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-ibm-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1018-ibm (Ubuntu package)
linux-image-bluefield (Ubuntu package)
linux-image-5.4.0-1032-bluefield (Ubuntu package)
linux-image-5.4.0-1037-gkeop (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1056-raspi (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1059-kvm (Ubuntu package)
linux-image-5.4.0-1066-gke (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-oracle-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1067-oracle (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-5.4.0-1068-gcp (Ubuntu package)
linux-image-gcp-lts-20.04 (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-aws-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1069-aws (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1073-azure (Ubuntu package)
linux-image-5.13.0-37-generic (Ubuntu package)
linux-image-5.13.0-37-generic-64k (Ubuntu package)
linux-image-5.13.0-37-generic-lpae (Ubuntu package)
linux-image-5.13.0-37-lowlatency (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.13.0-1018-kvm (Ubuntu package)
linux-image-5.13.0-1019-aws (Ubuntu package)
linux-image-5.13.0-1021-azure (Ubuntu package)
linux-image-5.13.0-1021-gcp (Ubuntu package)
linux-image-5.13.0-1022-raspi-nolpae (Ubuntu package)
linux-image-5.13.0-1022-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.13.0-1023-oracle (Ubuntu package)
linux-image-5.13.0-1025-oracle (Ubuntu package)
linux-image-oem-20.04d (Ubuntu package)
linux-image-5.14.0-1022-oem (Ubuntu package)
Pixel

How to mitigate CVE-2021-44733

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Migration Toolkit for Containers - addressed in versions 1.6.5, 1.7.2
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.11, 2.4.5, 2.5.0
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.173.162, 5.4.0.105.109, 5.13.0.37.46
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.173.162, 5.4.0.105.109, 5.13.0.37.46
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.173.162
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.173.162
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.173.162
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.173.162, 5.4.0.105.109, 5.13.0.37.46
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.173.162, 5.4.0.105.109, 5.13.0.37.46
linux-image-4.15.0-173-generic (Ubuntu package) - update to 4.15.0-173.182
linux-image-4.15.0-173-lowlatency (Ubuntu package) - update to 4.15.0-173.182
linux-image-4.15.0-173-generic-lpae (Ubuntu package) - update to 4.15.0-173.182
linux-image-dell300x (Ubuntu package) - update to 4.15.0.1038.40
linux-image-4.15.0-1038-dell300x (Ubuntu package) - update to 4.15.0-1038.43
linux-image-4.15.0-1090-oracle (Ubuntu package) - update to 4.15.0-1090.99
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1090.100
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1099.92
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1110.106, 5.4.0.1059.58, 5.13.0.1018.18
linux-image-4.15.0-1110-kvm (Ubuntu package) - update to 4.15.0-1110.113
linux-image-4.15.0-1119-gcp (Ubuntu package) - update to 4.15.0-1119.133
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1119.138
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1123.126
linux-image-4.15.0-1123-snapdragon (Ubuntu package) - update to 4.15.0-1123.132
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1124.127
linux-image-4.15.0-1124-aws (Ubuntu package) - update to 4.15.0-1124.133
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1134.107
linux-image-4.15.0-1134-azure (Ubuntu package) - update to 4.15.0-1134.147
kernel-debug-modules-extra - update to 4.18.0-372.9.1
kernel-doc - update to 4.18.0-372.9.1
bpftool - update to 4.18.0-372.9.1
kernel - update to 4.18.0-372.9.1
kernel-core - update to 4.18.0-372.9.1
kernel-cross-headers - update to 4.18.0-372.9.1
kernel-debug - update to 4.18.0-372.9.1
kernel-debug-core - update to 4.18.0-372.9.1
kernel-debug-devel - update to 4.18.0-372.9.1
kernel-debug-modules - update to 4.18.0-372.9.1
kernel-devel - update to 4.18.0-372.9.1
kernel-headers - update to 4.18.0-372.9.1
kernel-modules - update to 4.18.0-372.9.1
kernel-modules-extra - update to 4.18.0-372.9.1
kernel-tools - update to 4.18.0-372.9.1
kernel-tools-libs - update to 4.18.0-372.9.1
perf - update to 4.18.0-372.9.1
python3-perf - update to 4.18.0-372.9.1
kernel-abi-stablelists - update to 4.18.0-372.9.1
kernel (Red Hat package) - update to 4.18.0-372.9.1.el8
kernel-rt (Red Hat package) - update to 4.18.0-372.9.1.rt7.166.el8
linux (Debian package) - update to 4.19.232-1
ocfs2-kmp-rt - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-source-rt - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-devel-rt - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
ocfs2-kmp-rt-debuginfo - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
cluster-md-kmp-rt - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
cluster-md-kmp-rt-debuginfo - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
dlm-kmp-rt - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
dlm-kmp-rt-debuginfo - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
gfs2-kmp-rt - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
gfs2-kmp-rt-debuginfo - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt-debuginfo - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt-debugsource - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt-devel - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt-devel-debuginfo - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt_debug - update to 5.3.18-68.1
kernel-rt_debug-debuginfo - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt_debug-debugsource - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt_debug-devel - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-rt_debug-devel-debuginfo - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
kernel-syms-rt - addressed in versions 5.3.18-68.1, 5.3.18-150300.71.1
linux-image-oem (Ubuntu package) - addressed in versions 5.4.0.105.109, 5.4.0.105.119~18.04.90
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.105.109, 5.4.0.105.119~18.04.90
linux-image-5.4.0-105-generic-lpae (Ubuntu package) - addressed in versions 5.4.0-105.119, 5.4.0-105.119~18.04.1
linux-image-5.4.0-105-lowlatency (Ubuntu package) - addressed in versions 5.4.0-105.119, 5.4.0-105.119~18.04.1
linux-image-5.4.0-105-generic (Ubuntu package) - addressed in versions 5.4.0-105.119, 5.4.0-105.119~18.04.1
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.105.119~18.04.90
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.105.119~18.04.90
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.105.119~18.04.90
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.105.119~18.04.90
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.105.119~18.04.90
linux-image-ibm (Ubuntu package) - addressed in versions 5.4.0.1018.18, 5.4.0.1018.35
linux-image-ibm-lts-20.04 (Ubuntu package) - update to 5.4.0.1018.18
linux-image-5.4.0-1018-ibm (Ubuntu package) - addressed in versions 5.4.0-1018.20, 5.4.0-1018.20~18.04.1
linux-image-bluefield (Ubuntu package) - update to 5.4.0.1032.33
linux-image-5.4.0-1032-bluefield (Ubuntu package) - update to 5.4.0-1032.35
linux-image-5.4.0-1037-gkeop (Ubuntu package) - addressed in versions 5.4.0-1037.38, 5.4.0-1037.38~18.04.1
linux-image-gkeop-5.4 (Ubuntu package) - addressed in versions 5.4.0.1037.38~18.04.37, 5.4.0.1037.40
linux-image-gkeop (Ubuntu package) - update to 5.4.0.1037.40
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1056.58
linux-image-5.4.0-1056-raspi (Ubuntu package) - addressed in versions 5.4.0-1056.63, 5.4.0-1056.63~18.04.1
linux-image-raspi2 (Ubuntu package) - update to 5.4.0.1056.90
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1056.90, 5.13.0.1022.27
linux-image-5.4.0-1059-kvm (Ubuntu package) - update to 5.4.0-1059.62
linux-image-5.4.0-1066-gke (Ubuntu package) - addressed in versions 5.4.0-1066.69, 5.4.0-1066.69~18.04.1
linux-image-gke-5.4 (Ubuntu package) - addressed in versions 5.4.0.1066.69~18.04.30, 5.4.0.1066.76
linux-image-gke (Ubuntu package) - addressed in versions 5.4.0.1066.76, 5.8.0.1015.15, 5.13.0.1021.19
linux-image-oracle-lts-20.04 (Ubuntu package) - update to 5.4.0.1067.67
linux-image-5.4.0-1067-oracle (Ubuntu package) - addressed in versions 5.4.0-1067.72, 5.4.0-1067.72~18.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 5.4.0.1067.72~18.04.46, 5.13.0.1023.23, 5.13.0.1025.30~20.04.1
linux-image-gcp (Ubuntu package) - addressed in versions 5.4.0.1068.53, 5.13.0.1021.19, 5.13.0.1021.25~20.04.1
linux-image-5.4.0-1068-gcp (Ubuntu package) - addressed in versions 5.4.0-1068.72, 5.4.0-1068.72~18.04.1
linux-image-gcp-lts-20.04 (Ubuntu package) - update to 5.4.0.1068.77
linux-image-aws (Ubuntu package) - addressed in versions 5.4.0.1069.51, 5.13.0.1019.20, 5.13.0.1019.21~20.04.12
linux-image-aws-lts-20.04 (Ubuntu package) - update to 5.4.0.1069.71
linux-image-5.4.0-1069-aws (Ubuntu package) - addressed in versions 5.4.0-1069.73, 5.4.0-1069.73~18.04.1
linux-image-azure (Ubuntu package) - addressed in versions 5.4.0.1073.52, 5.13.0.1021.24~20.04.10
linux-image-azure-lts-20.04 (Ubuntu package) - update to 5.4.0.1073.71
linux-image-5.4.0-1073-azure (Ubuntu package) - addressed in versions 5.4.0-1073.76, 5.4.0-1073.76~18.04.1
linux-image-5.13.0-37-generic (Ubuntu package) - addressed in versions 5.13.0-37.42, 5.13.0-37.42~20.04.1
linux-image-5.13.0-37-generic-64k (Ubuntu package) - addressed in versions 5.13.0-37.42, 5.13.0-37.42~20.04.1
linux-image-5.13.0-37-generic-lpae (Ubuntu package) - addressed in versions 5.13.0-37.42, 5.13.0-37.42~20.04.1
linux-image-5.13.0-37-lowlatency (Ubuntu package) - addressed in versions 5.13.0-37.42, 5.13.0-37.42~20.04.1
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-generic-64k (Ubuntu package) - update to 5.13.0.37.46
linux-image-oem-20.04 (Ubuntu package) - update to 5.13.0.37.46
linux-image-5.13.0-1018-kvm (Ubuntu package) - update to 5.13.0-1018.19
linux-image-5.13.0-1019-aws (Ubuntu package) - addressed in versions 5.13.0-1019.21, 5.13.0-1019.21~20.04.1
linux-image-5.13.0-1021-azure (Ubuntu package) - update to 5.13.0-1021.24~20.04.1
linux-image-5.13.0-1021-gcp (Ubuntu package) - addressed in versions 5.13.0-1021.25, 5.13.0-1021.25~20.04.1
linux-image-5.13.0-1022-raspi-nolpae (Ubuntu package) - update to 5.13.0-1022.24
linux-image-5.13.0-1022-raspi (Ubuntu package) - update to 5.13.0-1022.24
linux-image-raspi-nolpae (Ubuntu package) - update to 5.13.0.1022.27
linux-image-5.13.0-1023-oracle (Ubuntu package) - update to 5.13.0-1023.28
linux-image-5.13.0-1025-oracle (Ubuntu package) - update to 5.13.0-1025.30~20.04.1
linux-image-oem-20.04d (Ubuntu package) - update to 5.14.0.1022.19
linux-image-5.14.0-1022-oem (Ubuntu package) - update to 5.14.0-1022.24
IBM Spectrum Protect Plus - update to 10.1.11
Pixel - update to 12L 2022-06-05

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins