CVE-2021-47068
Assigner: Linux
Published: 2024-02-29T22:37:41.736Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

net/nfc: fix use-after-free llcp_sock_bind/connect

Commits 8a4cd82d ("nfc: fix refcount leak in llcp_sock_connect()")
and c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()")
fixed a refcount leak bug in bind/connect but introduced a
use-after-free if the same local is assigned to 2 different sockets.

This can be triggered by the following simple program:
    int sock1 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
    int sock2 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
    memset( &addr, 0, sizeof(struct sockaddr_nfc_llcp) );
    addr.sa_family = AF_NFC;
    addr.nfc_protocol = NFC_PROTO_NFC_DEP;
    bind( sock1, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
    bind( sock2, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
    close(sock1);
    close(sock2);

Fix this by assigning NULL to llcp_sock->local after calling
nfc_llcp_local_put.

This addresses CVE-2021-23134.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: a1cdd18c49d2
lessThan: 26157c82ba75
status: affected
versionType: git
version: 18013007b596
lessThan: ccddad6dd285
status: affected
versionType: git
version: 538a6ff11516
lessThan: 18ae4a192a44
status: affected
versionType: git
version: adbb1d218c5f
lessThan: 48fba458fe54
status: affected
versionType: git
version: c89903c9eff2
lessThan: e32352070bca
status: affected
versionType: git
version: 6fb003e5ae18
lessThan: 6b7021ed36da
status: affected
versionType: git
version: 8c9e4971e142
lessThan: 374cdde4dcc9
status: affected
versionType: git
version: c33b1cc62ac0
lessThan: 18175fe17ae0
status: affected
versionType: git
version: c33b1cc62ac0
lessThan: c61760e6940d
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.12
status: affected
version: 0
lessThan: 5.12
status: unaffected
versionType: custom
version: 4.4.269
lessThanOrEqual: 4.4.*
status: unaffected
versionType: custom
version: 4.9.269
lessThanOrEqual: 4.9.*
status: unaffected
versionType: custom
version: 4.14.233
lessThanOrEqual: 4.14.*
status: unaffected
versionType: custom
version: 4.19.191
lessThanOrEqual: 4.19.*
status: unaffected
versionType: custom
version: 5.4.119
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.37
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.11.21
lessThanOrEqual: 5.11.*
status: unaffected
versionType: custom
version: 5.12.4
lessThanOrEqual: 5.12.*
status: unaffected
versionType: custom
version: 5.13
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: net/nfc: fix use-after-free llcp_sock_bind/connect
x_generator: engine: bippy-851b3ed3d212