Description
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Linux / Linuxunspecified – 4.12
- Linux / Linux5.5.0 – unspecified
- Linux / Linuxnext of 5.12.2 – unspecified
- Linux / Linux kernel5.5.0 – 5.10.43
- NETAPP / cloud_backup
- NETAPP / h300e_firmware
- NETAPP / h300s_firmware
- NETAPP / h410c_firmware
- NETAPP / h410s_firmware
- NETAPP / h500e_firmware
- NETAPP / h500s_firmware
- NETAPP / h700e_firmware
- NETAPP / h700s_firmware
- NETAPP / solidfire_baseboard_management_controller
Updated 35m ago · 8 sources