CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe
In the Linux kernel, the following vulnerability has been resolved:
phonet/pep: refuse to enable an unbound pipe
This ioctl() implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur:
1) We'd send an pipe enablement request with an invalid source object. 2) Later socket calls could BUG on the socket unexpectedly being connected yet not bound to a valid object.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47086?
CVE-2021-47086 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2021-47086?
To fix CVE-2021-47086, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which versions of the Linux kernel are affected by CVE-2021-47086?
CVE-2021-47086 affects several versions of the Linux kernel, specifically versions prior to 4.4.297 and between 4.5 and 5.15.12.
What components are involved in CVE-2021-47086?
CVE-2021-47086 involves the phonet/pep component of the Linux kernel.
Is CVE-2021-47086 a remote code execution vulnerability?
No, CVE-2021-47086 does not directly lead to remote code execution; it primarily concerns socket binding issues.