CVE-2021-33034

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-05-14 · updated 2026-08-13
Weakness: CWE-416

Description

In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.

Affected products

Debian Linux: 9.0
Fedoraproject Fedora: 34
Linux kernel: before 4.4.269; from 4.5 before 4.9.269; from 4.10 before 4.14.233; from 4.15 before 4.19.191; from 4.20 before 5.4.119; from 5.5 before 5.10.37 — fixed in 4.14.233, 4.19.191, 4.4.269, 4.9.269, 5.10.37, 5.11.21

How to fix

Upgrade to a fixed version: Linux kernel 4.14.233, 4.19.191, 4.4.269, 4.9.269. Check the vendor advisory for mitigations.

References

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5c4c8c9544099bb9043a10a5318130a943e32fc3
https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GI7Z7UBWBGD3ABNIL2DC7RQDCGA4UVQW/
https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-hci_send_acl
https://syzkaller.appspot.com/bug?id=2e1943a94647f7732dd6fc60368642d6e8dc91b1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5c4c8c9544099bb9043a10a5318130a943e32fc3
https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GI7Z7UBWBGD3ABNIL2DC7RQDCGA4UVQW/

Get alerted when CVE-2021-33034 or the next vulnerability affects your stack