PT-2021-8211 · Linux+3 · Linux Kernel+3
Syzbot
·
Published
2021-12-10
·
Updated
2025-04-01
·
CVE-2021-47598
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.16.0-rc4-syzkaller
Description
The vulnerability is related to the sch cake component in the Linux kernel. It is caused by the function
cake destroy() being called from cake init(), which is not supposed to happen because the core stack already handles the destruction of qdiscs. This can lead to a use-after-free condition, allowing an attacker to potentially elevate their privileges or cause a denial of service. The issue was identified by syzbot, which triggered the use-after-free condition.Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix for the sch cake vulnerability. Specifically, versions prior to 5.16.0-rc4-syzkaller are affected. As a temporary workaround, consider disabling the
cake destroy() function until a patch is available. However, this may have unintended consequences and should be approached with caution. The best course of action is to apply the official patch or update to a newer, unaffected version of the Linux kernel.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse