CVE Vulnerabilities

CVE-2021-29626

Use After Free

Published: Apr 07, 2021 | Modified: Nov 21, 2024
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
2.1 LOW
AV:L/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, copy-on-write logic failed to invalidate shared memory page mappings between multiple processes allowing an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name Vendor Start Version End Version
Freebsd Freebsd * 11.4 (excluding)
Freebsd Freebsd 12.0 (including) 12.2 (excluding)
Freebsd Freebsd 11.4 (including) 11.4 (including)
Freebsd Freebsd 11.4-beta1 (including) 11.4-beta1 (including)
Freebsd Freebsd 11.4-p1 (including) 11.4-p1 (including)
Freebsd Freebsd 11.4-p2 (including) 11.4-p2 (including)
Freebsd Freebsd 11.4-p3 (including) 11.4-p3 (including)
Freebsd Freebsd 11.4-p4 (including) 11.4-p4 (including)
Freebsd Freebsd 11.4-p5 (including) 11.4-p5 (including)
Freebsd Freebsd 11.4-rc1 (including) 11.4-rc1 (including)
Freebsd Freebsd 11.4-rc2 (including) 11.4-rc2 (including)
Freebsd Freebsd 12.2 (including) 12.2 (including)
Freebsd Freebsd 12.2-p1 (including) 12.2-p1 (including)
Freebsd Freebsd 12.2-p2 (including) 12.2-p2 (including)
Freebsd Freebsd 13.0-beta1 (including) 13.0-beta1 (including)
Freebsd Freebsd 13.0-beta2 (including) 13.0-beta2 (including)
Freebsd Freebsd 13.0-beta3 (including) 13.0-beta3 (including)
Freebsd Freebsd 13.0-beta4 (including) 13.0-beta4 (including)
Freebsd Freebsd 13.0-rc1 (including) 13.0-rc1 (including)
Freebsd Freebsd 13.0-rc2 (including) 13.0-rc2 (including)
Freebsd Freebsd 13.0-rc3 (including) 13.0-rc3 (including)
Freebsd Freebsd 13.0-rc4 (including) 13.0-rc4 (including)
Freebsd Freebsd 13.0-rc5 (including) 13.0-rc5 (including)

Potential Mitigations

References