CVE-2021-47013

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47013
In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834 Patch
https://git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d Patch
https://git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57 Patch
https://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7 Patch
https://git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d Patch
https://git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955 Patch
https://git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322 Patch
https://git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b Patch
https://git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834 Patch
https://git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d Patch
https://git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57 Patch
https://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7 Patch
https://git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d Patch
https://git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955 Patch
https://git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322 Patch
https://git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

09 Dec 2024, 17:59

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834 - () https://git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834 - Patch
References () https://git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d - () https://git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d - Patch
References () https://git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57 - () https://git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57 - Patch
References () https://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7 - () https://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7 - Patch
References () https://git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d - () https://git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d - Patch
References () https://git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955 - () https://git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955 - Patch
References () https://git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322 - () https://git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322 - Patch
References () https://git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b - () https://git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

21 Nov 2024, 06:35

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: net:emac/emac-mac: Se corrige un uso after free en emac_mac_tx_buf_send En emac_mac_tx_buf_send, llama a emac_tx_fill_tpd(..,skb,..). Si ocurre algún error en emac_tx_fill_tpd(), el skb se liberará mediante dev_kfree_skb(skb) en la rama de error de emac_tx_fill_tpd(). Pero el skb liberado todavía se usa a través de skb->len por netdev_sent_queue(,skb->len). Como observé que emac_tx_fill_tpd() no ha modificado el valor de skb->len, por lo tanto mi parche asigna skb->len a 'len' antes del posible free y usa 'len' en lugar de skb->len más tarde.
References () https://git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834 - () https://git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834 -
References () https://git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d - () https://git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d -
References () https://git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57 - () https://git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57 -
References () https://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7 - () https://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7 -
References () https://git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d - () https://git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d -
References () https://git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955 - () https://git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955 -
References () https://git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322 - () https://git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322 -
References () https://git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b - () https://git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b -

28 Feb 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-28 09:15

Updated : 2024-12-09 17:59

NVD link : CVE-2021-47013

Mitre link : CVE-2021-47013

CVE.ORG link : CVE-2021-47013

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free