Re: CVE-2021-3715 Linux kernel: use-after-free in route4_change() in net/sched/cls_route.c

[Rohit Keshri <rkeshri () redhat com>]

Thank you Greg,

Correction please,  This issue was fixed in the upstream Kernel 5.6 onward
with ef299cc3fa1a9
..
Rohit Keshri / Red Hat Product Security Team
PGP: OX01BC 858A 07B7 15C8 EF33 BFE2 2EEB 0CBC 84A4 4C2D

secalert () redhat com for urgent response


On Tue, Sep 7, 2021 at 3:47 PM Greg KH <greg () kroah com> wrote:

> On Tue, Sep 07, 2021 at 02:09:52PM +0530, Rohit Keshri wrote:
> > Hello Team,
> >
> > A flaw was found in the "Routing decision" classifier in the Linux
> kernel's
> > Traffic Control networking subsystem in the way it handled changing of
> > classification filters, leading to a use-after-free condition. This flaw
> > allows unprivileged local users to escalate their privileges on the
> system.
> > The highest threat from this vulnerability is confidentiality, integrity,
> > as well as system availability.
> >
> > This issue was fixed in the upstream Kernel 5.10 onward with
> ef299cc3fa1a9
>
> Note, commit ef299cc3fa1a ("net_sched: cls_route: remove the right
> filter from hashtable") came out in the 5.6 kernel release, in March of
> 2020, and was also backported to all relevant stable kernel releases at
> the beginning of April, 2020:
>         4.4.218 4.9.218 4.14.175 4.19.114 5.4.29 5.5.14
>
> How did 5.10 get messed up in this, it was not released until December
> 2020?
>
> thanks,
>
> greg k-h