CVE-2021-3573 is a use-after-free vulnerability in the Linux kernel's HCI subsystem, affecting versions prior to 5.13-rc5, including various Fedora and Red Hat Enterprise Linux distributions. A privileged local user can exploit this flaw by triggering a race condition during HCI device unregistration and other HCI socket operations. This vulnerability carries a CVSS score of 6.4 (Medium), indicating that an attacker with high privileges and high attack complexity could achieve high impact on confidentiality, integrity, and availability, potentially leading to system crashes or privilege escalation. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.13CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
5.13CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* | ||
5.13CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:* | ||
5.13CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:* | ||
5.13CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add() hci_sock_blacklist_del() hci_get_conn_info() hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.
Aug 10, 2021kernel: use-after-free in function hci_sock_bound_ioctl()
Jun 8, 2021