CVE-2021-3483: Use After Free
A flaw was found in the Nosy driver in the Linux kernel in versions prior to v5.12-rc6. It allows a device to be inserted twice into a doubly linked list, leading to use-after-free when one of these devices is removed.
Reference: https://www.openwall.com/lists/oss-security/2021/04/07/1
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=829933ef05a951c8ff140e814656d73e74915faf
Other sources
A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions before kernel 5.12-rc6 are affected
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.12 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
linux/kernel (Nosy driver)to a version that resolves this vulnerability.Fixed in v5.12-rc6Patch 829933ef05a951c8ff140e814656d73e74915faf - Compensating control
Until the kernel is upgraded to v5.12-rc6, mitigate exposure by preventing or restricting insertion/removal of devices that use the Nosy driver (e.g., via device access control/USB or hardware interface restrictions).
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3483?
CVE-2021-3483 has been rated as a moderate severity vulnerability due to the risk of use-after-free conditions.
How do I fix CVE-2021-3483?
To fix CVE-2021-3483, you should upgrade your Linux kernel to version 5.12 or later.
Which versions of the Linux kernel are affected by CVE-2021-3483?
CVE-2021-3483 affects all Linux kernel versions prior to 5.12-rc6.
Is CVE-2021-3483 relevant to Debian Linux users?
Yes, Debian Linux versions using kernels below 5.12 are vulnerable to CVE-2021-3483.
What type of systems does CVE-2021-3483 impact?
CVE-2021-3483 impacts systems using vulnerable versions of the Linux kernel, specifically those with the Nosy driver.