CVE-2021-3348: Race Condition
A flaw was found in the Linux kernel. A race codition in nbd ioctl may lead to a use-after-free read in nbdqueuerq causing a crash.
Upstream patch:
https://lore.kernel.org/linux-block/24dff677353e2e30a71d8b66c4dffdbdf77c4dbd.1611595239.git.josef@toxicpanda.com/
References:
https://www.openwall.com/lists/oss-security/2021/01/28/3
Other sources
nbdaddsocket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndbqueuerq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 5.10.12Patch CID-b98e762e3d71 - Compensating control
If local attackers have access to the nbd device, restrict access to the nbd device to trusted users/hosts (e.g., tighten device node permissions and/or control who can issue I/O requests to the /dev/nbd* device).
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3348?
CVE-2021-3348 has been classified as a moderate severity vulnerability.
How do I fix CVE-2021-3348?
To fix CVE-2021-3348, upgrade to a kernel version that is 5.10.223-1 or later, or 6.1.119-1 or later.
What systems are affected by CVE-2021-3348?
CVE-2021-3348 affects Linux Kernel versions up to and including 5.10.12 and Debian Linux version 9.0.
What type of vulnerability is CVE-2021-3348?
CVE-2021-3348 is a use-after-free vulnerability due to a race condition in the nbd ioctl.
Can CVE-2021-3348 lead to system crashes?
Yes, CVE-2021-3348 can lead to a system crash due to a use-after-free read in nbd_queue_rq.