CVE-2021-47068 Information

Mar 01, 2024 cve

Description

In the Linux kernel the following vulnerability has been resolved:

net/nfc: fix use-after-free llcp_sock_bind/connect

Commits 8a4cd82d ( fc: fix refcount leak in llcp_sock_connect()) and c33b1cc62 ( fc: fix refcount leak in llcp_sock_bind()) fixed a refcount leak bug in bind/connect but introduced a use-after-free if the same local is assigned to 2 different sockets.

This can be triggered by the following simple program: int sock1 = socket( AF_NFC SOCK_STREAM NFC_SOCKPROTO_LLCP ); int sock2 = socket( AF_NFC SOCK_STREAM NFC_SOCKPROTO_LLCP ); memset( &addr 0 sizeof(struct sockaddr_nfc_llcp) ); addr.sa_family = AF_NFC; addr.nfc_protocol = NFC_PROTO_NFC_DEP; bind( sock1 (struct sockaddr) &addr sizeof(struct sockaddr_nfc_llcp) ) bind( sock2 (struct sockaddr) &addr sizeof(struct sockaddr_nfc_llcp) ) close(sock1); close(sock2);

Fix this by assigning NULL to llcp_sock->local after calling nfc_llcp_local_put.

This addresses CVE-2021-23134.

Reference

Share on: