CVE-2021-47388
Samsung Enables Free Reallocation with Mac80211
Description
In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame"). Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame. Fix this by reloading the variable after the code that results in the reallocations, if any. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
INFO
Published Date :
May 21, 2024, 3:15 p.m.
Last Modified :
Dec. 30, 2024, 8:05 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2021-47388.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2021-47388 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2021-47388 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Dec. 30, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE NIST CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.4.271 up to (excluding) 4.4.286 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.9.271 up to (excluding) 4.9.285 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.14.235 up to (excluding) 4.14.249 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19.193 up to (excluding) 4.19.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.124 up to (excluding) 5.4.151 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.42 up to (excluding) 5.10.71 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.12.9 up to (excluding) 5.14.10 *cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:* Changed Reference Type https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 No Types Assigned https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 Patch Changed Reference Type https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 No Types Assigned https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 Patch Changed Reference Type https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78 No Types Assigned https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78 Patch Changed Reference Type https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78 No Types Assigned https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78 Patch Changed Reference Type https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4dd No Types Assigned https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4dd Patch Changed Reference Type https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4dd No Types Assigned https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4dd Patch Changed Reference Type https://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258 No Types Assigned https://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258 Patch Changed Reference Type https://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258 No Types Assigned https://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258 Patch Changed Reference Type https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32 No Types Assigned https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32 Patch Changed Reference Type https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32 No Types Assigned https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32 Patch Changed Reference Type https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0 No Types Assigned https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0 Patch Changed Reference Type https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0 No Types Assigned https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0 Patch Changed Reference Type https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8 No Types Assigned https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8 Patch Changed Reference Type https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8 No Types Assigned https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8 Patch Changed Reference Type https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb No Types Assigned https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb Patch Changed Reference Type https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb No Types Assigned https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 Added Reference https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78 Added Reference https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4dd Added Reference https://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258 Added Reference https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32 Added Reference https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0 Added Reference https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8 Added Reference https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 21, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame"). Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame. Fix this by reloading the variable after the code that results in the reallocations, if any. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401. Added Reference kernel.org https://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4dd [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2021-47388 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2021-47388
weaknesses.