{"id":"CVE-2021-47111","state":"PUBLISHED","title":"xen-netback: take a reference to the RX task thread","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: take a reference to the RX task thread\n\nDo this in order to prevent the task from being freed if the thread\nreturns (which can be triggered by the frontend) before the call to\nkthread_stop done as part of the backend tear down. Not taking the\nreference will lead to a use-after-free in that scenario. Such\nreference was taken before but dropped as part of the rework done in\n2ac061ce97f4.\n\nReintroduce the reference taking and add a comment this time\nexplaining why it's needed.\n\nThis is XSA-374 / CVE-2021-28691.","publishedAt":"2024-03-15T20:14:19.898Z","updatedAt":"2026-08-05T08:46:04.618Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2ac061ce97f413bfbbdd768f7d2e0fda2e8170df","status":"affected","lessThan":"6b53db8c4c14b4e7256f058d202908b54a7b85b4","versionType":"git"},{"version":"2ac061ce97f413bfbbdd768f7d2e0fda2e8170df","status":"affected","lessThan":"caec9bcaeb1a5f03f2d406305355c853af10c13e","versionType":"git"},{"version":"2ac061ce97f413bfbbdd768f7d2e0fda2e8170df","status":"affected","lessThan":"107866a8eb0b664675a260f1ba0655010fac1e08","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/xen-netback/interface.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.43","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.12.10","status":"unaffected","lessThanOrEqual":"5.12.*","versionType":"semver"},{"version":"5.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/xen-netback/interface.c"]}],"references":["https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4","https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e","https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47111.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47111","state":"PUBLISHED","datePublished":"2024-03-15T20:14:19.898Z","dateUpdated":"2026-08-05T08:46:04.618Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-03-04T18:12:48.836Z"},"containers":{"cna":{"title":"xen-netback: take a reference to the RX task thread","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: take a reference to the RX task thread\n\nDo this in order to prevent the task from being freed if the thread\nreturns (which can be triggered by the frontend) before the call to\nkthread_stop done as part of the backend tear down. Not taking the\nreference will lead to a use-after-free in that scenario. Such\nreference was taken before but dropped as part of the rework done in\n2ac061ce97f4.\n\nReintroduce the reference taking and add a comment this time\nexplaining why it's needed.\n\nThis is XSA-374 / CVE-2021-28691."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2ac061ce97f413bfbbdd768f7d2e0fda2e8170df","status":"affected","lessThan":"6b53db8c4c14b4e7256f058d202908b54a7b85b4","versionType":"git"},{"version":"2ac061ce97f413bfbbdd768f7d2e0fda2e8170df","status":"affected","lessThan":"caec9bcaeb1a5f03f2d406305355c853af10c13e","versionType":"git"},{"version":"2ac061ce97f413bfbbdd768f7d2e0fda2e8170df","status":"affected","lessThan":"107866a8eb0b664675a260f1ba0655010fac1e08","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/xen-netback/interface.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.43","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.12.10","status":"unaffected","lessThanOrEqual":"5.12.*","versionType":"semver"},{"version":"5.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/xen-netback/interface.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4"},{"url":"https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e"},{"url":"https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The attack is carried out by a Xen guest through the PV netfront shared rings and event channels on the same host, not via remote network packets or physical device access.\nAC:L - The guest reliably triggers the bug by posting a malformed TX request (e.g. excess slots or cross-page offsets) to force the RX kthread to exit, then switching the frontend xenstore state to Closing/Closed to cause backend teardown and the UAF; both steps are fully attacker-controlled.\nPR:L - Exploitation requires a guest domain with a configured PV network frontend (typical cloud/tenant guest control), which is low privilege relative to Dom0 and does not require host-admin rights.\nUI:N - No victim user action is required; the guest alone can send the malformed frontend requests and drive the disconnect state change.\nS:C - This is a Xen guest-to-host escape: a DomU compromises Dom0 kernel memory via UAF in xen-netback, crossing the guest/host security boundary.\nC:H - Use-after-free of a host task_struct can be leveraged for arbitrary kernel memory disclosure; XSA-374 explicitly states information leaks cannot be ruled out.\nI:H - The same UAF enables heap reuse and control-flow hijacking in Dom0, and XSA-374 states privilege escalation cannot be ruled out.\nA:H - Calling kthread_stop() on the freed task_struct can crash or hang Dom0, which XSA-374 confirms as a host denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:46:04.618Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.43"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.12.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-26T20:36:51.215407Z","id":"CVE-2021-47111","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-26T20:36:58.053Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:24:39.854Z"}}]}}}