CVE-2021-37159: Use After Free
A flaw use-after-free in the Linux kernel USB High Speed Mobile Devices functionality was found in the way user detaches USB device. A local user could use this flaw to crash the system or escalate their privileges on the system.
Other sources
hsofreenetdevice in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregisternetdev without checking for the NETREGREGISTERED state, leading to a use-after-free and a double free.
In hsofreenetdevice of net/usb/hso.c, there is a possible use after free bug. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.rt7.166.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2022-03-05 - Configuration
Prevent the hso module from being loaded automatically to mitigate the use-after-free vulnerability.
Linux kernel hso module module loading = disabled
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-37159?
CVE-2021-37159 has a medium severity rating, allowing local users to cause a crash or escalate privileges.
How do I fix CVE-2021-37159?
To fix CVE-2021-37159, update your Linux kernel to versions 0:4.18.0-372.9.1.rt7.166.el8 or 0:4.18.0-372.9.1.el8, or ensure your system is running a patched version of the kernel.
Which versions of the Linux kernel are affected by CVE-2021-37159?
CVE-2021-37159 affects Linux kernel versions prior to 5.13.4 and other specific distributions such as Debian Linux 9.0 and certain Oracle communications software versions.
Can CVE-2021-37159 be exploited remotely?
CVE-2021-37159 is not remotely exploitable as it requires local user access to be triggered.
What kind of devices are impacted by CVE-2021-37159?
CVE-2021-37159 impacts USB High Speed Mobile Devices functionality within the Linux kernel.