Vulnerability in Linux

CVE-2021-47294

In the Linux kernel, the following vulnerability has been resolved: netrom: Decrease sock refcount when sock timers expire Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use sock timer API. It replaces mod_timer() by sk_reset_timer(), and del_timer() by sk_stop_timer(). Function sk_reset_timer() will increase the refcount of sock if it is called on an inactive timer, hence, in case the timer expires, we need to decrease the refcount ourselves in the handler, otherwise, the sock refcount will be unbalanced and the sock will never be freed.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.003 (18.7th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 18.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2021-47294: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

  • Linux — versions 519e8a22a454b1f1baa3a151b184fe51bc18e178, 63346650c1a94a92be61a57416ac88c0a47c4327, 5.13.6
  • Linux Kernel — versions 3.18.134, 4.20.7, 5.14

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2021-47294?
CVE-2021-47294 is a medium-severity vulnerability in Linux, classified under Operation on a Resource after Expiration or Release. CVSS score: 5.5/10. Published 2024-05-21.
How severe is CVE-2021-47294?
Medium severity. CVSS v3 base score is 5.5 out of 10.