Log in Start free

Vulnerability · Published May 21, 2024 · Assigned by Linux

CVE-2021-47294netrom: Decrease sock refcount when sock timers expire

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 79.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: netrom: Decrease sock refcount when sock timers expire Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use sock timer API. It replaces mod_timer() by sk_reset_timer(), and del_timer() by sk_stop_timer(). Function sk_reset_timer() will increase the refcount of sock if it is called on an inactive timer, hence, in case the timer expires, we need to decrease the refcount ourselves in the handler, otherwise, the sock refcount will be unbalanced and the sock will never be freed.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.14.6-1DEBIAN-CVE-2021-47294
Debian:13linux5.14.6-1DEBIAN-CVE-2021-47294
Debian:14linux5.14.6-1DEBIAN-CVE-2021-47294
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47294
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47294
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47294

Affected products (as reported)

VendorProductVersions
Linux Linux ce29e8a259de767f7210d346ad2b031cb8ab2732 – before 853262355518cd1247515b74e83fabf038aa6c29baa9e32336bf6d0d74a7c3486d2a27feaf57cd5f – before a01634bf91f2b6c42583770eb6815fb6d1e251cf0adf571fa34b27bd0b97b408cc0f0dc54b72f0eb – before 48866fd5c361ea417ed24b43fc2a7dc2f5b060ef2c6b572458a9127e8070df13fa7f115c29ab1d92 – before 9619cc7d97c3aa8ed3cfd2b8678b74fb6d6c795063346650c1a94a92be61a57416ac88c0a47c4327 – before 25df44e90ff5959b5c24ad361b648504a7e39ef363346650c1a94a92be61a57416ac88c0a47c4327 – before 6811744bd0efb9e472cb15d066cdb460beb8cb8a63346650c1a94a92be61a57416ac88c0a47c4327 – before bc1660206c3723c37ed4d622ad81781f1e98725063346650c1a94a92be61a57416ac88c0a47c4327 – before 517a16b1a88bdb6b530f48d5d153478b2552d9a8
Linux Linux 5.0

References