SB2024060481 - Use-after-free in Linux kernel cisco enic driver
Published: June 4, 2024 Updated: May 13, 2025
Security Bulletin ID
SB2024060481
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2021-46998)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the enic_queue_wq_skb_encap(), enic_queue_wq_skb() and enic_hard_start_xmit() functions in drivers/net/ethernet/cisco/enic/enic_main.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976
- https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3
- https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1
- https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3
- https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24
- https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.191
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.38
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.22
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.5
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.120