CVE-2021-47024

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47024

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: vsock/virtio: free queued packets when closing socket As reported by syzbot [1], there is a memory leak while closing the socket. We partially solved this issue with commit ac03046ece2b ("vsock/virtio: free packets during the socket release"), but we forgot to drain the RX queue when the socket is definitely closed by the scheduled work. To avoid future issues, let's use the new virtio_transport_remove_sock() to drain the RX queue before removing the socket from the af_vsock lists calling vsock_remove_sock(). [1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9

References
Link Resource
https://git.kernel.org/stable/c/27691665145e74a45034a9dccf1150cf1894763a Patch
https://git.kernel.org/stable/c/37c38674ef2f8d7e8629e5d433c37d6c1273d16b Patch
https://git.kernel.org/stable/c/8432b8114957235f42e070a16118a7f750de9d39 Patch
https://git.kernel.org/stable/c/b605673b523fe33abeafb2136759bcbc9c1e6ebf Patch
https://git.kernel.org/stable/c/27691665145e74a45034a9dccf1150cf1894763a Patch
https://git.kernel.org/stable/c/37c38674ef2f8d7e8629e5d433c37d6c1273d16b Patch
https://git.kernel.org/stable/c/8432b8114957235f42e070a16118a7f750de9d39 Patch
https://git.kernel.org/stable/c/b605673b523fe33abeafb2136759bcbc9c1e6ebf Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

06 Dec 2024, 20:53

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/27691665145e74a45034a9dccf1150cf1894763a - () https://git.kernel.org/stable/c/27691665145e74a45034a9dccf1150cf1894763a - Patch
References () https://git.kernel.org/stable/c/37c38674ef2f8d7e8629e5d433c37d6c1273d16b - () https://git.kernel.org/stable/c/37c38674ef2f8d7e8629e5d433c37d6c1273d16b - Patch
References () https://git.kernel.org/stable/c/8432b8114957235f42e070a16118a7f750de9d39 - () https://git.kernel.org/stable/c/8432b8114957235f42e070a16118a7f750de9d39 - Patch
References () https://git.kernel.org/stable/c/b605673b523fe33abeafb2136759bcbc9c1e6ebf - () https://git.kernel.org/stable/c/b605673b523fe33abeafb2136759bcbc9c1e6ebf - Patch

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/27691665145e74a45034a9dccf1150cf1894763a - () https://git.kernel.org/stable/c/27691665145e74a45034a9dccf1150cf1894763a -
References () https://git.kernel.org/stable/c/37c38674ef2f8d7e8629e5d433c37d6c1273d16b - () https://git.kernel.org/stable/c/37c38674ef2f8d7e8629e5d433c37d6c1273d16b -
References () https://git.kernel.org/stable/c/8432b8114957235f42e070a16118a7f750de9d39 - () https://git.kernel.org/stable/c/8432b8114957235f42e070a16118a7f750de9d39 -
References () https://git.kernel.org/stable/c/b605673b523fe33abeafb2136759bcbc9c1e6ebf - () https://git.kernel.org/stable/c/b605673b523fe33abeafb2136759bcbc9c1e6ebf -
Information

Published : 2024-02-28 09:15

Updated : 2024-12-06 20:53

NVD link : CVE-2021-47024

Mitre link : CVE-2021-47024

CVE.ORG link : CVE-2021-47024

JSON object : View

Products Affected

linux

CWE
CWE-401

Missing Release of Memory after Effective Lifetime