PT-2024-11170 · Linux+7 · Linux Kernel+7

Mark Rutland

·

Published

2021-06-05

·

Updated

2025-02-27

·

CVE-2021-47118

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.13-rc3
Description The vulnerability is related to the initialization of cad pid in the Linux kernel. During boot, kernel init freeable() initializes cad pid to the init task's struct pid. Later, when cad pid is changed via a sysctl, proc do cad pid() increments the refcount on the new pid via get pid() and decrements the refcount on the old pid via put pid(). However, since get pid() was not called when cad pid was initialized, a reference is decremented that was never incremented, which can lead to the init task's struct pid being freed early. This can cause dangling references to the struct pid, resulting in a use-after-free issue when delivering signals.
Recommendations To resolve this issue, get a reference to the init task's struct pid when assigning it to cad pid. This can be done by calling get pid() when initializing cad pid.
Note: The provided input does not specify the exact versions that are vulnerable or the versions that contain the fix. However, based on the information given, it appears that versions prior to 5.13-rc3 are affected.

Fix

Use After Free

Double Free

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2024:3618
ALSA-2024:3627
BDU:2025-03651
CESA-2024_3618
CESA-2024_3627
CVE-2021-47118
INFSA-2024_3618
INFSA-2024_3627
OPENSUSE-SU-2024_1489-1
RHSA-2024:3618
RHSA-2024:3627
RHSA-2024_3618
RHSA-2024_3627
RLSA-2024:3618
RLSA-2024:3627
SUSE-SU-2024:1454-1
SUSE-SU-2024:1465-1
SUSE-SU-2024:1489-1
SUSE-SU-2024:1643-1
SUSE-SU-2024:1646-1
SUSE-SU-2024:1870-1
USN-7183-1
USN-7184-1

Affected Products

Almalinux
Astra Linux
Centos
Linux Kernel
Red Hat
Rocky Linux
Suse
Ubuntu