{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhamradio: defer ax25 kfree after unregister_netdev\n\nThere is a possible race condition (use-after-free) like below\n\n (USE)                       |  (FREE)\nax25_sendmsg                 |\n ax25_queue_xmit             |\n  dev_queue_xmit             |\n   __dev_queue_xmit          |\n    __dev_xmit_skb           |\n     sch_direct_xmit         | ...\n      xmit_one               |\n       netdev_start_xmit     | tty_ldisc_kill\n        __netdev_start_xmit  |  mkiss_close\n         ax_xmit             |   kfree\n          ax_encaps          |\n                             |\n\nEven though there are two synchronization primitives before the kfree:\n1. wait_for_completion(&ax->dead). This can prevent the race with\nroutines from mkiss_ioctl. However, it cannot stop the routine coming\nfrom upper layer, i.e., the ax25_sendmsg.\n\n2. netif_stop_queue(ax->dev). It seems that this line of code aims to\nhalt the transmit queue but it fails to stop the routine that already\nbeing xmit.\n\nThis patch reorder the kfree after the unregister_netdev to avoid the\npossible UAF as the unregister_netdev() is well synchronized and won't\nreturn if there is a running routine."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "versions": [
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "b5b193d0c671",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "8a1a314965a1",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "eaa816a86e62",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "896193a02a29",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "ef5f7bfa19e3",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "450121075a6a",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "cb6c99aedd2c",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "3e0588c291d6",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "versions": [
                  {
                     "version": "4.4.297",
                     "lessThanOrEqual": "4.4.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "4.9.295",
                     "lessThanOrEqual": "4.9.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "4.14.260",
                     "lessThanOrEqual": "4.14.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "4.19.223",
                     "lessThanOrEqual": "4.19.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.4.169",
                     "lessThanOrEqual": "5.4.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.10.89",
                     "lessThanOrEqual": "5.10.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.15.12",
                     "lessThanOrEqual": "5.15.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.16",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/b5b193d0c67180fefdc664650138e3b7959df615"
            },
            {
               "url": "https://git.kernel.org/stable/c/8a1a314965a17c62084a056b4f2cb7a770854c90"
            },
            {
               "url": "https://git.kernel.org/stable/c/eaa816a86e629cbcc0a94f38391fee09231628c7"
            },
            {
               "url": "https://git.kernel.org/stable/c/896193a02a2981e60c40d4614fd095ce92135ccd"
            },
            {
               "url": "https://git.kernel.org/stable/c/ef5f7bfa19e3fc366f4c6d1a841ceaddf7a9f5d4"
            },
            {
               "url": "https://git.kernel.org/stable/c/450121075a6a6f1d50f97225d3396315309d61a1"
            },
            {
               "url": "https://git.kernel.org/stable/c/cb6c99aedd2c843056a598a8907a6128cb07603b"
            },
            {
               "url": "https://git.kernel.org/stable/c/3e0588c291d6ce225f2b891753ca41d45ba42469"
            }
         ],
         "title": "hamradio: defer ax25 kfree after unregister_netdev",
         "x_generator": {
            "engine": "bippy-4986f5686161"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2021-47084",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}