#VU90232 Use-after-free in Linux kernel - CVE-2021-47103

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a use-after-free error within the inet6_sk_rx_dst_set(), tcp_v6_do_rcv() and tcp_v6_early_demux() functions in net/ipv6/tcp_ipv6.c, within the udp_sk_rx_dst_set(), __udp4_lib_rcv() and udp_v4_early_demux() functions in net/ipv4/udp.c, within the tcp_v4_do_rcv(), tcp_v4_early_demux(), tcp_prequeue() and inet_sk_rx_dst_set() functions in net/ipv4/tcp_ipv4.c, within the tcp_rcv_established() function in net/ipv4/tcp_input.c, within the tcp_disconnect() function in net/ipv4/tcp.c, within the inet_sock_destruct() function in net/ipv4/af_inet.c. A local user can send specially crafted packets to the system, trigger a use-after-free error and potentially execute arbitrary code.

Remediation

External links

• https://git.kernel.org/stable/c/68c34ce11ef23328692aa35fa6aaafdd75913100
• https://git.kernel.org/stable/c/92e6e36ecd16808866ac6172b9491b5097cde449
• https://git.kernel.org/stable/c/75a578000ae5e511e5d0e8433c94a14d9c99c412
• https://git.kernel.org/stable/c/c3bb4a7e8cbc984e1cdac0fe6af60e880214ed6e
• https://git.kernel.org/stable/c/f039b43cbaea5e0700980c2f0052da05a70782e0
• https://git.kernel.org/stable/c/0249a4b8a554f2eb6a27b62516fa50168584faa4
• https://git.kernel.org/stable/c/8f905c0e7354ef261360fb7535ea079b1082c105
• https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.296
• https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.262
• https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.331
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.150
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.12
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.220