CVE-2021-46936
Linux Kernel: Netstats Use-After-Free Vulnerability in tw_timer_handler
Description
In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0 RIP: 0010:tw_timer_handler+0x20/0x40 Call Trace: <IRQ> call_timer_fn+0x2b/0x120 run_timer_softirq+0x1ef/0x450 __do_softirq+0x10d/0x2b8 irq_exit+0xc7/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20 This issue was also reported since 2017 in the thread [1], unfortunately, the issue was still can be reproduced after fixing DCCP. The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net namespace is destroyed since tcp_sk_ops is registered befrore ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops in the list of pernet_list. There will be a use-after-free on net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net if there are some inflight time-wait timers. This bug is not introduced by commit f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH") since the net_statistics is a global variable instead of dynamic allocation and freeing. Actually, commit 61a7e26028b9 ("mib: put net statistics on struct net") introduces the bug since it put net statistics on struct net and free it when net namespace is destroyed. Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug and replace pr_crit() with panic() since continuing is meaningless when init_ipv4_mibs() fails. [1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1
INFO
Published Date :
Feb. 27, 2024, 10:15 a.m.
Last Modified :
April 10, 2024, 7:20 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2021-46936.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2021-46936 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2021-46936 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
Initial Analysis by [email protected]
Apr. 10, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Reference Type https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13 No Types Assigned https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13 Patch Changed Reference Type https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022 No Types Assigned https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022 Patch Changed Reference Type https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4 No Types Assigned https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4 Patch Changed Reference Type https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4 No Types Assigned https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4 Patch Changed Reference Type https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566 No Types Assigned https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566 Patch Changed Reference Type https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 No Types Assigned https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 Patch Changed Reference Type https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41a No Types Assigned https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41a Patch Changed Reference Type https://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69 No Types Assigned https://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69 Patch Added CWE NIST CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.27 up to (excluding) 4.4.298 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.5.0 up to (excluding) 4.9.296 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10.0 up to (excluding) 4.14.261 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15.0 up to (excluding) 4.19.224 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20.0 up to (excluding) 5.4.170 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5.0 up to (excluding) 5.10.90 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11.0 up to (excluding) 5.15.13 -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Feb. 27, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0 RIP: 0010:tw_timer_handler+0x20/0x40 Call Trace: <IRQ> call_timer_fn+0x2b/0x120 run_timer_softirq+0x1ef/0x450 __do_softirq+0x10d/0x2b8 irq_exit+0xc7/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20 This issue was also reported since 2017 in the thread [1], unfortunately, the issue was still can be reproduced after fixing DCCP. The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net namespace is destroyed since tcp_sk_ops is registered befrore ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops in the list of pernet_list. There will be a use-after-free on net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net if there are some inflight time-wait timers. This bug is not introduced by commit f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH") since the net_statistics is a global variable instead of dynamic allocation and freeing. Actually, commit 61a7e26028b9 ("mib: put net statistics on struct net") introduces the bug since it put net statistics on struct net and free it when net namespace is destroyed. Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug and replace pr_crit() with panic() since continuing is meaningless when init_ipv4_mibs() fails. [1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1 Added Reference Linux https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41a [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2021-46936 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2021-46936
weaknesses.