CVE-2021-46973

Severity CVSS v4.0:

Pending analysis

Type:

CWE-416 Use After Free

Publication date:

27/02/2024

Last modified:

14/03/2025

Description

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Avoid potential use after free in MHI send It is possible that the MHI ul_callback will be invoked immediately following the queueing of the skb for transmission, leading to the callback decrementing the refcount of the associated sk and freeing the skb. As such the dereference of skb and the increment of the sk refcount must happen before the skb is queued, to avoid the skb to be used after free and potentially the sk to drop its last refcount..

Impact

Vector 3.x

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 8.40 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

8.40

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:o:linux:linux_kernel::::::::	5.8 (including)	5.10.35 (including)
cpe:2.3:o:linux:linux_kernel::::::::	5.11 (including)	5.11.19 (including)
cpe:2.3:o:linux:linux_kernel::::::::	5.12 (including)	5.12.2 (including)

To consult the complete list of CPE names with products and versions, see this page

CVE-2021-46973

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools