CVE-2021-47538
rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Need to call rxrpc_put_local() for peer candidate before kfree() as it holds a ref to rxrpc_local. [DH: v2: Changed to abstract the peer freeing code out into a function]
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/3e70e3a72d80b16094faccbe438cd53761c3503a
- https://git.kernel.org/stable/c/60f0b9c42cb80833a03ca57c1c8b078d716e71d1
- https://git.kernel.org/stable/c/913c24af2d13a3fd304462916ee98e298d56bdce
- https://git.kernel.org/stable/c/9469273e616ca8f1b6e3773c5019f21b4c8d828c
- https://git.kernel.org/stable/c/beacff50edbd6c9659a6f15fc7f6126909fade29
References (5)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.