CVE-2021-28691: Use After Free
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthreadstop will be performed against a stale pointer.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-28691?
CVE-2021-28691 has a medium severity level due to the potential for a denial of service attack.
How do I fix CVE-2021-28691?
To fix CVE-2021-28691, upgrade the Linux kernel to version 5.10.223-1, 5.10.226-1, or a later version.
What software is affected by CVE-2021-28691?
CVE-2021-28691 affects the Linux kernel versions between 5.5.0 and 5.12.2 and also impacts specific NetApp firmware versions.
What symptoms indicate an exploitation of CVE-2021-28691?
An exploitation of CVE-2021-28691 can cause the network interface to be disabled and associated kernel threads to terminate unexpectedly.
Is there a workaround for CVE-2021-28691 while I wait to update my system?
A temporary workaround for CVE-2021-28691 is not documented, so updating to the patched versions is recommended as the primary mitigation.