CVE-2021-3640CWE-362

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way…

published March 3, 2022

CVSS
—
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.7th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2022-03-03T22:04Z
EPSS history
Timeline
  • 03 MAR 22:04Z
    A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way…
    cvelistv5