Vulnerability Details : CVE-2021-28951

An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25.

Vulnerability category: Denial of service

Published 2021-03-20 20:15:14

Updated 2022-05-12 20:14:46

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-28951

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 12 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2021-28951

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.9	MEDIUM	AV:L/AC:L/Au:N/C:N/I:N/A:C	3.9	6.9	[email protected]
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	1.8	3.6	[email protected]
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2021-28951

CWE-667 Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Assigned by: [email protected] (Primary)

References for CVE-2021-28951

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3ebba796fa251d042be42b929a2d916ee5c34a49

Patch;Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/

Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/[email protected]/message/PTRNPQTZ4GVS46SZ4OBXY5YDOGVPSTGQ/

Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/[email protected]/message/4VCKIOXCOZGXBEZMO5LGGV5MWCHO6FT3/

Mailing List;Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20210430-0003/

Third Party Advisory

CVEs referencing this url

Products affected by CVE-2021-28951

Linux » Linux Kernel
Versions up to, including, (<=) 5.11.8
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Netapp » Cloud Backup » Version: N/A
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Matching versions
Netapp » Aff 500f Firmware » Version: N/A
cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Aff 500f » Version: N/A
Netapp » Solidfire Baseboard Management Controller Firmware » Version: N/A
cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Solidfire Baseboard Management Controller » Version: N/A
Netapp » Fas 500f Firmware » Version: N/A
cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Fas 500f » Version: N/A
Netapp » A250 Firmware » Version: N/A
cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » A250 » Version: N/A