UBUNTU-CVE-2021-47576: Use After Free

Q: Which systems are realistically exposed to this issue?

Systems running an affected Ubuntu kernel package are exposed when the Linux SCSI debug driver is in use. The listed packages include linux, linux-fips, linux-azure, linux-aws, linux-aws-fips, linux-azure-fips, linux-gcp, and linux-gcp-fips.

Q: What does an attacker need to exploit the vulnerability?

The provided severity vector indicates local access, low attack complexity, no user interaction, and high privileges are required. The flaw is triggered through malformed block descriptor length handling in the SCSI debug driver's MODE SELECT response path.

Q: What is the likely impact of successful exploitation?

The defect is a use-after-free condition that can cause a read from freed memory in resp_mode_select(). The supplied vector indicates low confidentiality and integrity impact and high availability impact.

Published Jun 19, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Sanity check block descriptor length in respmodeselect() In respmodeselect() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in respmodeselect+0xa4c/0xb40 drivers/scsi/scsidebug.c:2509 Read of size 1 at addr ffff888026670f50 by task scsicmd/15032 CPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Call Trace: <TASK> dumpstacklvl+0x89/0xb5 lib/dumpstack.c:107 printaddressdescription.constprop.9+0x28/0x160 mm/kasan/report.c:257 kasanreport.cold.14+0x7d/0x117 mm/kasan/report.c:443 asanreportload1noabort+0x14/0x20 mm/kasan/reportgeneric.c:306 respmodeselect+0xa4c/0xb40 drivers/scsi/scsidebug.c:2509 scheduleresp+0x4af/0x1a10 drivers/scsi/scsidebug.c:5483 scsidebugqueuecommand+0x8c9/0x1e70 drivers/scsi/scsidebug.c:7537 scsiqueuerq+0x16b4/0x2d10 drivers/scsi/scsilib.c:1521 blkmqdispatchrqlist+0xb9b/0x2700 block/blk-mq.c:1640 blkmqscheddispatchrequests+0x28f/0x590 block/blk-mq-sched.c:325 blkmqscheddispatchrequests+0x105/0x190 block/blk-mq-sched.c:358 blkmqrunhwqueue+0xe5/0x150 block/blk-mq.c:1762 blkmqdelayrunhwqueue+0x4f8/0x5c0 block/blk-mq.c:1839 blkmqrunhwqueue+0x18d/0x350 block/blk-mq.c:1891 blkmqschedinsertrequest+0x3db/0x4e0 block/blk-mq-sched.c:474 blkexecuterqnowait+0x16b/0x1c0 block/blk-exec.c:63 sgcommonwrite.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837 sgnewwrite.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775 sgioctlcommon+0x14d6/0x2710 drivers/scsi/sg.c:941 sgioctl+0xa2/0x180 drivers/scsi/sg.c:1166 x64sysioctl+0x19d/0x220 fs/ioctl.c:52 dosyscall64+0x3a/0x80 arch/x86/entry/common.c:50 entrySYSCALL64afterhwframe+0x44/0xae arch/x86/entry/entry64.S:113

Affected Software

120 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1131.144~14.04.1

4.15.0-1131.144~14.04.1

ubuntu/linux*

ubuntu/linux-aws<4.4.0-1145.151

4.4.0-1145.151

ubuntu/linux-lts-xenial<4.4.0-270.304~14.04.1

4.4.0-270.304~14.04.1

ubuntu/linux<4.4.0-270.304

4.4.0-270.304

ubuntu/linux-aws<4.4.0-1183.198

4.4.0-1183.198

ubuntu/linux-aws-hwe<4.15.0-1120.128~16.04.1

4.15.0-1120.128~16.04.1

ubuntu/linux-azure<4.15.0-1131.144~16.04.1

4.15.0-1131.144~16.04.1

ubuntu/linux-gcp<4.15.0-1116.130~16.04.1

4.15.0-1116.130~16.04.1

ubuntu/linux-hwe<4.15.0-169.177~16.04.1

4.15.0-169.177~16.04.1

ubuntu/linux-kvm<4.4.0-1146.157

4.4.0-1146.157

ubuntu/linux-oracle<4.15.0-1087.95~16.04.1

4.15.0-1087.95~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1115.122

4.4.0-1115.122

ubuntu/linux-fips*

ubuntu/linux<4.15.0-169.177

4.15.0-169.177

ubuntu/linux-aws<4.15.0-1121.129

4.15.0-1121.129

ubuntu/linux-aws-5.4<5.4.0-1069.73~18.04.1

5.4.0-1069.73~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1131.144

4.15.0-1131.144

ubuntu/linux-azure-5.4<5.4.0-1073.76~18.04.1

5.4.0-1073.76~18.04.1

ubuntu/linux-gcp-4.15<4.15.0-1116.130

4.15.0-1116.130

ubuntu/linux-gcp-5.4<5.4.0-1068.72~18.04.1

5.4.0-1068.72~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-105.119~18.04.1

5.4.0-105.119~18.04.1

ubuntu/linux-ibm-5.4<5.4.0-1018.20~18.04.1

5.4.0-1018.20~18.04.1

ubuntu/linux-kvm<4.15.0-1107.109

4.15.0-1107.109

ubuntu/linux-oracle<4.15.0-1087.95

4.15.0-1087.95

ubuntu/linux-oracle-5.4<5.4.0-1067.72~18.04.1

5.4.0-1067.72~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1056.63~18.04.1

5.4.0-1056.63~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2061.63

4.15.0-2061.63

ubuntu/linux-azure-fips<4.15.0-2043.47

4.15.0-2043.47

ubuntu/linux-fips<4.15.0-1078.87

4.15.0-1078.87

ubuntu/linux-gcp-fips<4.15.0-2026.28

4.15.0-2026.28

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-105.119

5.4.0-105.119

ubuntu/linux-aws<5.4.0-1069.73

5.4.0-1069.73

ubuntu/linux-azure<5.4.0-1073.76

5.4.0-1073.76

ubuntu/linux-bluefield<5.4.0-1032.35

5.4.0-1032.35

ubuntu/linux-gcp<5.4.0-1068.72

5.4.0-1068.72

ubuntu/linux-gkeop<5.4.0-1037.38

5.4.0-1037.38

ubuntu/linux-ibm<5.4.0-1018.20

5.4.0-1018.20

ubuntu/linux-kvm<5.4.0-1059.62

5.4.0-1059.62

ubuntu/linux-oracle<5.4.0-1067.72

5.4.0-1067.72

ubuntu/linux-raspi<5.4.0-1056.63

5.4.0-1056.63

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1069.73+fips2

5.4.0-1069.73+fips2

ubuntu/linux-azure-fips<5.4.0-1073.76+fips1

5.4.0-1073.76+fips1

ubuntu/linux-fips<5.4.0-1046.52

5.4.0-1046.52

ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1

5.4.0-1067.71~20.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.144~14.04.1
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1145.151
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-270.304~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-270.304
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1183.198
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1120.128~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.144~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1116.130~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-169.177~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1146.157
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1087.95~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1115.122
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-169.177
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1121.129
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.144
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1116.130
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1068.72~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-105.119~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1018.20~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1107.109
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1087.95
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.72~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.63~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2061.63
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2043.47
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1078.87
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2026.28
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-105.119
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1032.35
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1068.72
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1037.38
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1018.20
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1059.62
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.72
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.63
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73+fips2
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1046.52
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71~20.04.1

Event History

Jun 19, 2024

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are realistically exposed to this issue?

Systems running an affected Ubuntu kernel package are exposed when the Linux SCSI debug driver is in use. The listed packages include linux, linux-fips, linux-azure, linux-aws, linux-aws-fips, linux-azure-fips, linux-gcp, and linux-gcp-fips.

What does an attacker need to exploit the vulnerability?

The provided severity vector indicates local access, low attack complexity, no user interaction, and high privileges are required. The flaw is triggered through malformed block descriptor length handling in the SCSI debug driver's MODE SELECT response path.

What is the likely impact of successful exploitation?

The defect is a use-after-free condition that can cause a read from freed memory in resp_mode_select(). The supplied vector indicates low confidentiality and integrity impact and high availability impact.

UBUNTU-CVE-2021-47576: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the likely impact of successful exploitation?