Use-after-free in wayland - CVE-2021-3782

Vulnerability identifier: #VU67416

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2021-3782

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
wayland
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
OpenShift Developer Tools and Services
Migration Toolkit for Runtimes
libwayland-client0 (Ubuntu package)
libwayland-bin (Ubuntu package)
libwayland-cursor0 (Ubuntu package)
libwayland-server0 (Ubuntu package)
libwayland-server0
libwayland-cursor0
wayland-devel-debuginfo
libwayland-client0-debuginfo
libwayland-client0
libwayland-cursor0-debuginfo
libwayland-server0-debuginfo
wayland-debugsource
wayland-devel
libwayland-egl1 (Ubuntu package)
libwayland-server0-32bit-debuginfo
libwayland-server0-32bit
libwayland-client0-32bit
libwayland-client0-32bit-debuginfo
wayland
wayland-debuginfo
wayland-help
libwayland-cursor0-32bit
wayland-devel-32bit
wayland-devel-32bit-debuginfo
libwayland-cursor0-32bit-debuginfo
libwayland-cursor
libwayland-client
wayland-doc
libwayland-egl
libwayland-server
wayland (Red Hat package)
libwayland-egl1
libwayland-egl1-debuginfo
libwayland-egl1-32bit
libwayland-egl1-32bit-debuginfo
Red Hat OpenShift Container Platform

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error caused by incorrectly handled reference counting
certain objects. A local user can perform a denial of service (DoS) attack against the Wayland compositor or execute arbitrary code with elevated privileges.

Install updates from vendor's website.

• https://gitlab.freedesktop.org/wayland/wayland/-/issues/224
• https://gitlab.freedesktop.org/wayland/wayland/-/commit/b19488c7154b902354cb26a27f11415d7799b0b2