Vulnerability CVE-2021-28691: Information

Description

Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.

Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-28691
Published: June 29, 2021
Modified: April 6, 2022
Error type identifier: CWE-416

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
kernel-image-mpsisyphus5.12.4-alt16.8.8-alt1ALT-PU-2021-1833-1272140Fixed
kernel-image-mpp105.12.4-alt16.1.19-alt1ALT-PU-2021-1833-1272140Fixed
kernel-image-mpp95.12.16-alt15.12.16-alt1ALT-PU-2021-3481-1279859Fixed
kernel-image-rpi-defsisyphus5.15.25-alt15.15.92-alt2ALT-PU-2022-1419-1296090Fixed
kernel-image-rpi-defp105.15.25-alt15.15.92-alt2ALT-PU-2022-1421-1296181Fixed
kernel-image-rpi-unsisyphus5.12.6-alt16.6.23-alt1ALT-PU-2021-1888-1273055Fixed
kernel-image-rpi-unp105.12.6-alt16.1.77-alt1ALT-PU-2021-1888-1273055Fixed
kernel-image-rpi-unp95.12.6-alt15.12.17-alt1ALT-PU-2021-1896-1273084Fixed
kernel-image-rtsisyphus6.1.28-alt1.rt106.1.90-alt2.rt30ALT-PU-2023-1814-1320645Fixed
kernel-image-std-debugsisyphus5.10.54-alt16.1.91-alt1ALT-PU-2021-2370-1281272Fixed
kernel-image-std-defsisyphus5.10.43-alt16.1.91-alt1ALT-PU-2021-1989-1274386Fixed
kernel-image-std-defp105.10.43-alt15.10.216-alt1ALT-PU-2021-1989-1274386Fixed
kernel-image-std-defc9f25.10.43-alt0.c9f5.10.214-alt0.c9f.2ALT-PU-2021-2012-1274388Fixed
kernel-image-un-defsisyphus5.12.10-alt16.6.31-alt1ALT-PU-2021-1990-1274393Fixed
kernel-image-un-defsisyphus_riscv645.19.16-alt2.rv646.6.29-alt1.0.portALT-PU-2022-6777-1-Fixed
kernel-image-un-defp105.12.10-alt16.1.85-alt1ALT-PU-2021-1990-1274393Fixed
kernel-image-un-defp95.10.45-alt15.10.216-alt2ALT-PU-2021-2042-1274787Fixed
kernel-image-un-defc10f15.12.10-alt16.1.85-alt0.c10f.1ALT-PU-2021-1990-1274393Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://xenbits.xenproject.org/xsa/advisory-374.txt
  • Third Party Advisory
GLSA-202107-30
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20210805-0002/
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
      Start including
      5.5.0
      End excliding
      5.12.2

      Configuration 2

      cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

      Configuration 5

      cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

      Configuration 6

      cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

      Configuration 7

      cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

      Configuration 8

      cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

      Configuration 9

      cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

      Configuration 10

      cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.1
Back to top