PT-2024-11285 · Linux+2 · Linux Kernel+2
Published
2021-06-10
·
Updated
2024-12-24
·
CVE-2021-47281
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a race condition in the
snd seq timer open() function, where the timer instance per queue is exclusive, but concurrent accesses are not properly managed. This can lead to a situation where a later concurrent call of snd seq timer open() may override the timer instance, resulting in a Use After Free (UAF) condition. The UAF can occur when the leftover timer instance continues to run after the queue itself has been closed. To avoid the race, a proper check is added at the assignment of tmr->timeri to return -EBUSY if it has already been registered.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse