Use After Free in Linux
CVE-2021-47342
In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible UAF when remounting r/o a mmp-protected file system After commit 618f003199c6 ("ext4: fix memory leak in ext4_fill_super"), after the file system is remounted read-only, there is a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to point at freed memory, which the call to ext4_stop_mmpd() can trip over. Fix this by only allowing kmmpd() to exit when it is stopped via ext4_stop_mmpd(). Bug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>
Vulnerability class: Use-After-Free
EPSS: 0.002 (15.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions 5.10.51, 5.12.18, 618f003199c6188e01472b03cdbba227f1dc5f24
- Linux Linux_kernel
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2021-47342?
- CVE-2021-47342 is a high-severity vulnerability in Linux, classified under Use After Free. CVSS score: 7.8/10. Published 2024-05-21.
- How severe is CVE-2021-47342?
- High severity. CVSS v3 base score is 7.8 out of 10.