Homepage
About Snyk

Use After Free Affecting kernel-zfcpdump-modules-extra package, versions *

Severity

 Recommended
0.0
medium
0
10

Based on CentOS security rating

    Threat Intelligence

    EPSS
    0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-CENTOS8-KERNELZFCPDUMPMODULESEXTRA-6982451
  • published 22 May 2024
  • disclosed 21 May 2024
Report a new vulnerability Found a mistake?

Introduced: 21 May 2024

CVE-2021-47357 Open this link in a new tab
CWE-416 Open this link in a new tab

How to fix?

There is no fixed version for Centos:8 kernel-zfcpdump-modules-extra.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-zfcpdump-modules-extra package and not the kernel-zfcpdump-modules-extra package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

atm: iphase: fix possible use-after-free in ia_module_exit()

This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.

CVSS Scores

version 3.1
Expand this section

Red Hat

6.7 medium
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    High
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High