CVE-2021-46929: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-46929 is a use-after-free vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. The issue occurs when an SCTP association is peeled off and the old socket (sk) is freed after getting it by asoc->base.sk and before calling lock_sock(sk) (Kernel Git).

The vulnerability manifests in the sctp_sock_dump() function when handling SCTP socket operations. The issue arises from a race condition where the endpoint's socket can be freed while still being accessed. The bug was discovered through KASAN (Kernel Address Sanitizer) which detected the use-after-free condition in the __lock_acquire function (Kernel Git).

This vulnerability could allow an attacker to trigger an out-of-bounds write through a specially crafted operation, potentially leading to arbitrary code execution on the target system or causing a system crash (Kernel Git).

The vulnerability requires the ability to interact with the SCTP subsystem and can be triggered through specific socket operations. It was discovered and reported by the Syzkaller automated testing system and confirmed through practical testing (Kernel Git).

The issue was fixed by implementing a call_rcu mechanism to delay the endpoint free operation. The fix moves the sock_put and endpoint free operations into sctp_endpoint_destroy_rcu(), making it safe to hold the endpoint under rcu_read_lock in sctp_transport_traverse_process(). The port release is not delayed as it happens in sctp_endpoint_destroy() before calling call_rcu() (Kernel Git).