{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47281", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T13:27:52.128Z", "datePublished": "2024-05-21T14:20:07.499Z", "dateUpdated": "2026-08-05T08:47:03.896Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:47:03.896Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix race of snd_seq_timer_open()\n\nThe timer instance per queue is exclusive, and snd_seq_timer_open()\nshould have managed the concurrent accesses. It looks as if it's\nchecking the already existing timer instance at the beginning, but\nit's not right, because there is no protection, hence any later\nconcurrent call of snd_seq_timer_open() may override the timer\ninstance easily. This may result in UAF, as the leftover timer\ninstance can keep running while the queue itself gets closed, as\nspotted by syzkaller recently.\n\nFor avoiding the race, add a proper check at the assignment of\ntmr->timeri again, and return -EBUSY if it's been already registered." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached through local ioctls on /dev/snd/seq (CREATE_QUEUE, SET_QUEUE_TIMER, SET_QUEUE_CLIENT, close), not via network or adjacent protocols.\nAC:L - The attacker controls both sides of the race by issuing concurrent sequencer ioctls/closes from multiple threads or processes on queues they create, as syzkaller did; success does not depend on victim state outside attacker influence.\nPR:L - Exploitation needs only the ability to open /dev/snd/seq as an unprivileged user (audio group, seat uaccess/ACL, or MIDI-capable app on phones); snd_seq_open imposes no capability checks.\nUI:N - The attacker triggers the race solely with their own open/ioctl/close operations; no action by another user is required.\nS:U - Impact stays within the host kernel authority (local privilege escalation / kernel memory corruption); it does not cross a VM, IOMMU, or other security boundary.\nC:H - The race orphans a running timer whose callback retains a pointer to a freed queue, producing a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same UAF on the queue object enables heap reuse and control-flow hijacking primitives, so integrity impact is high under kernel memory-corruption guidance.\nA:H - The UAF is observed as a kernel oops in softirq timer context (snd_seq_timer_interrupt), which can crash or hang the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/core/seq/seq_timer.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "bd7d88b0874f82f7b29d1a53e574cedaf23166ba", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "536a7646c00a0f14fee49e5e313109e5da2f6031", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "83e197a8414c0ba545e7e3916ce05f836f349273", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/core/seq/seq_timer.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.44", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12.11", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.12.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/bd7d88b0874f82f7b29d1a53e574cedaf23166ba" }, { "url": "https://git.kernel.org/stable/c/536a7646c00a0f14fee49e5e313109e5da2f6031" }, { "url": "https://git.kernel.org/stable/c/83e197a8414c0ba545e7e3916ce05f836f349273" } ], "title": "ALSA: seq: Fix race of snd_seq_timer_open()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47281", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-23T21:20:28.570330Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:13:56.494Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.027Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/bd7d88b0874f82f7b29d1a53e574cedaf23166ba", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/536a7646c00a0f14fee49e5e313109e5da2f6031", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/83e197a8414c0ba545e7e3916ce05f836f349273", "tags": [ "x_transferred" ] } ] } ] } }