CVE-2021-33034
Public on 2021-05-14
Modified on 2021-07-15
Description
A use-after-free flaw was found in hci_send_acl in the bluetooth host controller interface (HCI) in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system The issue results from the object hchan, freed in hci_disconn_loglink_complete_evt, yet still used in other places. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
Severity
See what this means
CVSS v3 Base Score
See breakdown
Affected Packages
Platform | Package | Release Date | Advisory | Status |
---|---|---|---|---|
Amazon Linux 2 - Core | kernel | 2021-07-16 | ALAS2-2021-1685 | Fixed |
Amazon Linux 2 - Kernel-5.10 Extra | kernel | 2022-01-28 | ALAS2KERNEL-5.10-2022-002 | Fixed |
Amazon Linux 2 - Kernel-5.4 Extra | kernel | 2022-01-28 | ALAS2KERNEL-5.4-2022-004 | Fixed |
Amazon Linux 2 - Livepatch Extra | kernel-livepatch-4.14.225-168.357 | 2021-07-12 | ALAS2LIVEPATCH-2021-050 | Fixed |
Amazon Linux 2 - Livepatch Extra | kernel-livepatch-4.14.225-169.362 | 2021-07-12 | ALAS2LIVEPATCH-2021-051 | Fixed |
Amazon Linux 2 - Livepatch Extra | kernel-livepatch-4.14.231-173.360 | 2021-07-12 | ALAS2LIVEPATCH-2021-052 | Fixed |
Amazon Linux 2 - Livepatch Extra | kernel-livepatch-4.14.231-173.361 | 2021-07-12 | ALAS2LIVEPATCH-2021-053 | Fixed |
CVSS Scores
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
NVD | CVSSv2 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
NVD | CVSSv3 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |