Log in Start free

Vulnerability · Published Aug 13, 2021 · Assigned by redhat

CVE-2021-3573

Medium 6.4

In plain English

A medium-severity race condition in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.4Medium
Exploit odds (30 days)0.4%top 68.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8kernel-tools-libs-devel4.18.0-348.el8ALSA-2021:4356
Debian:12linux5.10.46-1DEBIAN-CVE-2021-3573
Debian:13linux5.10.46-1DEBIAN-CVE-2021-3573
Debian:14linux5.10.46-1DEBIAN-CVE-2021-3573
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-3573
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-3573
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-3573

Affected products (as reported)

VendorProductVersions
n/a kernel kernel 5.13-rc5

Weakness: CWE-362

References