CVE-2021-3659: Null Pointer Dereference
A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.
Other sources
The bug is inside net/mac802154/llsec.c (IEEE 802.15.4 support). If fails allocating of the cipher handle for AEAD during initialization of LR-WPAN, then NULL pointer dereference could happen.
Reference: https://syzkaller.appspot.com/bug?extid=12cf5fbfdeba210a89dd
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1165affd484889d4986cf3b724318935a0b120d8
The previously used CVE for this one was CVE-2021-33033 (because this issue already incorrectly referenced before from that older CVE).
— Red Hat
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3659?
The severity of CVE-2021-3659 is high due to its impact on system availability.
How do I fix CVE-2021-3659?
To fix CVE-2021-3659, upgrade to the patched versions of the Linux kernel as specified by your distribution, such as kernel-rt 0:4.18.0-348.rt7.130.el8 or kernel 0:4.18.0-348.el8.
What causes CVE-2021-3659?
CVE-2021-3659 is caused by a NULL pointer dereference flaw in the IEEE 802.15.4 wireless networking subsystem of the Linux kernel.
Which Linux distributions are affected by CVE-2021-3659?
CVE-2021-3659 affects several Linux distributions including Red Hat Enterprise Linux, Fedora, and Debian.
Can CVE-2021-3659 be exploited remotely?
No, CVE-2021-3659 is a local vulnerability that requires local user access to the system to exploit.