CVE-2021-28691

Published: 29 June 2021

Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.

From the Ubuntu Security Team

Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service or possibly execute arbitrary code.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28691
• https://xenbits.xen.org/xsa/advisory-374.html
• https://ubuntu.com/security/notices/USN-5015-1
• https://ubuntu.com/security/notices/USN-5046-1
• https://ubuntu.com/security/notices/USN-5050-1
• NVD
• Launchpad
• Debian