A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.
2022-03-03T23:15:08.197
2024-11-21T06:22:03.073
Modified
CVSSv3.1: 7.0 (HIGH)
AV:L/AC:M/Au:N/C:C/I:C/A:C
3.4
10.0
Type | Vendor | Product | Version/Range | Vulnerable? |
---|---|---|---|---|
Operating System | linux | linux_kernel | < 4.4.293 | Yes |
Operating System | linux | linux_kernel | < 4.9.291 | Yes |
Operating System | linux | linux_kernel | < 4.14.256 | Yes |
Operating System | linux | linux_kernel | < 4.19.218 | Yes |
Operating System | linux | linux_kernel | < 5.4.160 | Yes |
Operating System | linux | linux_kernel | < 5.10.80 | Yes |
Operating System | linux | linux_kernel | < 5.14.19 | Yes |
Operating System | linux | linux_kernel | < 5.15.3 | Yes |
Operating System | debian | debian_linux | 9.0 | Yes |
Operating System | fedoraproject | fedora | 34 | Yes |
Operating System | canonical | ubuntu_linux | 14.04 | Yes |
Operating System | canonical | ubuntu_linux | 16.04 | Yes |
Operating System | canonical | ubuntu_linux | 18.04 | Yes |
Operating System | canonical | ubuntu_linux | 20.04 | Yes |
Operating System | canonical | ubuntu_linux | 21.10 | Yes |
Operating System | netapp | h300s_firmware | - | Yes |
Hardware | netapp | h300s | - | No |
Operating System | netapp | h700s_firmware | - | Yes |
Hardware | netapp | h700s | - | No |
Operating System | netapp | h300e_firmware | - | Yes |
Hardware | netapp | h300e | - | No |
Operating System | netapp | h500e_firmware | - | Yes |
Hardware | netapp | h500e | - | No |
Operating System | netapp | h700e_firmware | - | Yes |
Hardware | netapp | h700e | - | No |
Operating System | netapp | h410s_firmware | - | Yes |
Hardware | netapp | h410s | - | No |
Operating System | netapp | h410c_firmware | - | Yes |
Hardware | netapp | h410c | - | No |
Operating System | netapp | h500s_firmware | - | Yes |
Hardware | netapp | h500s | - | No |