CVE-2021-23134
Linux kernel llcp_sock_bind/connect use-after-free
- State
- Published
- Severity
- 7.8 High
- Published
- May 12, 2021
- Updated
- Sep 17, 2024
- Reserved
- Jan 6, 2021
Description
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | palo_alto |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
Linux KernelLinux Kernel |
|
References
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=c61760e6940d
- https://www.openwall.com/lists/oss-security/2021/05/11/4
- FEDORA-2021-286375de1evendor-advisory
- FEDORA-2021-05152dbcf5vendor-advisory
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security updatemailing-list
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security updatemailing-list
- https://security.netapp.com/advisory/ntap-20210625-0007/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.