CVE-2021-47082: tun: avoid double free in tun_free_netdev
In the Linux kernel, the following vulnerability has been resolved:
tun: avoid double free in tunfreenetdev
Avoid double free in tunfreenetdev() by moving the dev->tstats and tun->security allocs to a new ndoinit routine (tunnetinit()) that will be called by registernetdevice(). ndoinit is paired with the desctructor (tunfreenetdev()), so if there's an error in registernetdevice() the destructor will handle the frees.
BUG: KASAN: double-free or invalid-free in selinuxtundevfreesecurity+0x1a/0x20 security/selinux/hooks.c:5605
CPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1 Hardware name: Red Hat KVM, BIOS Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x89/0xb5 lib/dumpstack.c:106 printaddressdescription.constprop.9+0x28/0x160 mm/kasan/report.c:247 kasanreportinvalidfree+0x55/0x80 mm/kasan/report.c:372 kasanslabfree mm/kasan/common.c:346 [inline] kasanslabfree+0x107/0x120 mm/kasan/common.c:374 kasanslabfree include/linux/kasan.h:235 [inline] slabfreehook mm/slub.c:1723 [inline] slabfreefreelisthook mm/slub.c:1749 [inline] slabfree mm/slub.c:3513 [inline] kfree+0xac/0x2d0 mm/slub.c:4561 selinuxtundevfreesecurity+0x1a/0x20 security/selinux/hooks.c:5605 securitytundevfreesecurity+0x4f/0x90 security/security.c:2342 tunfreenetdev+0xe6/0x150 drivers/net/tun.c:2215 netdevruntodo+0x4df/0x840 net/core/dev.c:10627 rtnlunlock+0x13/0x20 net/core/rtnetlink.c:112 tunchrioctl+0x80c/0x2870 drivers/net/tun.c:3302 tunchrioctl+0x2f/0x40 drivers/net/tun.c:3311 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:874 [inline] sesysioctl fs/ioctl.c:860 [inline] x64sysioctl+0x19d/0x220 fs/ioctl.c:860 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3a/0x80 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Apply the kernel fix: avoid double free in tun_free_netdev() by moving dev->tstats and tun->security allocations to a new ndo_init routine named tun_net_init() that is called by register_netdevice(). Ensure tun_free_netdev() pairs with this ndo_init so destructor frees execute correctly, including when register_netdevice() errors.
Linux kernel (tun driver) ndo_init/tun_net_init pairing with tun_free_netdev = Implement tun_net_init() and move dev->tstats and tun->security allocs to it so register_netdevice() calls ndo_init; ensure error paths in register_netdevice() rely on tun_free_netdev() destructor for frees
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47082?
The severity of CVE-2021-47082 is considered to be moderate, as it involves a double free vulnerability in the Linux kernel.
How do I fix CVE-2021-47082?
To fix CVE-2021-47082, you should upgrade your Linux kernel to a version that contains the patch addressing this vulnerability.
Which versions are affected by CVE-2021-47082?
CVE-2021-47082 affects various versions of the Linux kernel from 4.20 to 5.16-rc6.
Is CVE-2021-47082 being actively exploited?
As of now, there is no public evidence that CVE-2021-47082 is being actively exploited in the wild.
What systems are at risk from CVE-2021-47082?
Systems running vulnerable versions of the Linux kernel, specifically those within the specified version ranges, are at risk from CVE-2021-47082.