CVE - CVE-2021-46936

CVE-ID
CVE-2021-46936	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0 RIP: 0010:tw_timer_handler+0x20/0x40 Call Trace: <IRQ> call_timer_fn+0x2b/0x120 run_timer_softirq+0x1ef/0x450 __do_softirq+0x10d/0x2b8 irq_exit+0xc7/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20 This issue was also reported since 2017 in the thread [1], unfortunately, the issue was still can be reproduced after fixing DCCP. The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net namespace is destroyed since tcp_sk_ops is registered befrore ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops in the list of pernet_list. There will be a use-after-free on net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net if there are some inflight time-wait timers. This bug is not introduced by commit f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH") since the net_statistics is a global variable instead of dynamic allocation and freeing. Actually, commit 61a7e26028b9 ("mib: put net statistics on struct net") introduces the bug since it put net statistics on struct net and free it when net namespace is destroyed. Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug and replace pr_crit() with panic() since continuing is meaningless when init_ipv4_mibs() fails. [1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13 URL:https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13 MISC:https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022 URL:https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022 MISC:https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4 URL:https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4 MISC:https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4 URL:https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4 MISC:https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566 URL:https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566 MISC:https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 URL:https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 MISC:https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41a URL:https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41a MISC:https://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69 URL:https://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69
Assigning CNA
kernel.org
Date Record Created
20240225	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240225)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)