PT-2021-6407 · Linux+4 · Linux Kernel+4

Published 2021-10-08 · Updated 2023-08-14 · CVE-2021-45868

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.3

Description The issue is related to the use of memory after it has been freed in the Linux kernel, specifically in the fs/quota/quota tree.c component. This occurs when checking the block number in the quota tree on disk. The exploitation of this issue can lead to a denial of service. If a quota file is corrupted, it may result in a use-after-free condition in kernel/locking/rwsem.c.

Recommendations For Linux kernel versions prior to 5.15.3, update to version 5.15.3 or later to resolve the issue. As a temporary workaround, consider restricting access to corrupted quota files to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2021-3330

ALT-PU-2021-3358

ALT-PU-2021-3563

ALT-PU-2021-3573

ALT-PU-2021-3660

ALT-PU-2022-1240

ALT-PU-2022-1419

ALT-PU-2022-1421

ALT-PU-2023-1814

ALT-PU-2023-4894

BDU:2022-01512

CVE-2021-45868

OESA-2022-1940

OPENSUSE-SU-2022_1163-1

OPENSUSE-SU-2022_1183-1

OPENSUSE-SU-2022_1256-1

SUSE-SU-2022:1163-1

SUSE-SU-2022:1183-1

SUSE-SU-2022:1196-1

SUSE-SU-2022:1197-1

SUSE-SU-2022:1255-1

SUSE-SU-2022:1256-1

SUSE-SU-2022:1257-1

SUSE-SU-2022:1266-1

SUSE-SU-2022:1267-1

SUSE-SU-2022:1270-1

SUSE-SU-2022:1283-1

SUSE-SU-2022:1402-1

SUSE-SU-2022:1407-1

SUSE-SU-2023:0416-1

USN-6001-1

USN-6013-1

USN-6014-1

Affected Products

Alt Linux

Astra Linux

Linux Kernel

Suse

Ubuntu

References · 402

• 🔥 https://openwall.com/lists/oss-security/2022/03/17/1 · Exploit
• 🔥 https://bugzilla.kernel.org/show_bug.cgi?id=214655 · Exploit
• 🔥 https://openwall.com/lists/oss-security/2022/03/17/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3656 · Security Note
• https://ubuntu.com/security/CVE-2021-28713 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3772 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3646 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4203 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1095 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01512 · Security Note
• https://ubuntu.com/security/CVE-2022-47929 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0617 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1516 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45868 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0487 · Vendor Advisory