CVE-2021-27646: (Pwn2Own) Synology DiskStation Manager iscsi_snapshot_comm_core Use-After-Free Remote Code Execution Vulnerability
First published: Fri Mar 12 2021(Updated: )
This vulnerability allows local attackers to execute arbitrary code on affected installations of Synology DS418play. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iscsi_snapshot_comm_core service. The issue results from the lack of proper locking when performing operations on an object, which can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the current process.
Credit: security@synology.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Synology DiskStation Manager | ||
| Synology DiskStation Manager | <6.2.3-25426-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-27646.
What is the severity of CVE-2021-27646?
The severity of CVE-2021-27646 is critical with a CVSS score of 9.8.
How can local attackers exploit CVE-2021-27646?
Local attackers can exploit CVE-2021-27646 to execute arbitrary code on affected installations of Synology DS418play.
Is authentication required to exploit CVE-2021-27646?
No, authentication is not required to exploit CVE-2021-27646.
What is the affected software for CVE-2021-27646?
The affected software for CVE-2021-27646 is Synology DiskStation Manager version up to 6.2.3-25426-3.
- collector/zdi-advisory
- alias/ZDI-21-340
- alias/ZDI-CAN-13476
- alias/CVE-2021-27646
- collector/nvd-index
- vendor/synology
- canonical/synology diskstation manager