Log in Start free

Vulnerability · Published Apr 17, 2021 · Assigned by canonical

CVE-2021-3492Ubuntu linux kernel shiftfs file system double free vulnerability

High 8.8

In plain English

A high-severity double free in Linux kernel from Ubuntu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.5%top 25.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-3492
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-3492
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-3492

Affected products (as reported)

VendorProductVersions
Ubuntu Linux kernel 5.8 kernel – before 5.8.0-50.565.4 kernel – before 5.4.0-72.80

Weakness: CWE-415, CWE-401 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References