CVE-2021-3752

Published: 17 September 2021

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

From the Ubuntu security team

Likang Luo discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Priority

Medium

CVSS 3 base score: 7.1

Status

Notes

this is more difficult to trigger due to the presence of
3af70b39fa2d415dc86c370e5b24ddb9fdacbd6f

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3752
• https://www.openwall.com/lists/oss-security/2021/09/15/4
• https://ubuntu.com/security/notices/USN-5265-1
• https://ubuntu.com/security/notices/USN-5267-1
• https://ubuntu.com/security/notices/USN-5268-1
• https://ubuntu.com/security/notices/USN-5267-3
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=1999544