CVE-2021-47427CWE-416

CVE-2021-47427

Critical · published May 21, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi: Fix iscsi_task use after free

Commit d39df158518c ("scsi: iscsi: Have abort handler get ref to conn")

added iscsi_get_conn()/iscsi_put_conn() calls during abort handling but

then also changed the handling of the case where we detect an already

completed task where we now end up doing a goto to the common put/cleanup

code. This results in a iscsi_task use after free, because the common

cleanup code will do a put on the iscsi_task.

This reverts the goto and moves the iscsi_get_conn() to after we've checked

if the iscsi_task is valid.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-416 · Use After Free
Published
2024-05-21T19:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 5.14, < 5.14.125.14.12
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (4)
EPSS history
Timeline
  • 21 MAY 15:04Z
    scsi: iscsi: Fix iscsi_task use after free
    cvelistv5