PT-2021-8180 · Linux+3 · Linux Kernel+3
Kevin Tanguy
+1
·
Published
2021-11-11
·
Updated
2024-10-25
·
CVE-2021-47209
CVSS v2.0
6.8
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a use-after-free error in the Linux kernel's sched/fair component. This error occurs when the
unregister fair sched group() function unlinks all cfs rqs from a dying task group without protecting itself from interruptions. If a timer interrupt triggers during this process, the sched cfs period timer() function may execute and attempt to unthrottle cfs rqs, leading to a situation where these cfs rqs are freed while still being linked. This can result in a crash or potentially allow an attacker to elevate privileges in the system. The root cause of the issue is the tg unthrottle up() function being called via sched cfs period timer() at an inconvenient time.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse