7.8

CVE-2021-47235

net: ethernet: fix potential use-after-free in ec_bhf_remove

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: fix potential use-after-free in ec_bhf_remove

static void ec_bhf_remove(struct pci_dev *dev)
{
...
	struct ec_bhf_priv *priv = netdev_priv(net_dev);

	unregister_netdev(net_dev);
	free_netdev(net_dev);

	pci_iounmap(dev, priv->dma_io);
	pci_iounmap(dev, priv->io);
...
}

priv is netdev private data, but it is used
after free_netdev(). It can cause use-after-free when accessing priv
pointer. So, fix it by moving free_netdev() after pci_iounmap()
calls.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.15 < 4.4.274
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.274
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.238
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.196
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.128
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.46
Linux ≫ Linux Kernel Version >= 5.11 < 5.12.13
Linux ≫ Linux Kernel Version5.13 Updaterc1
Linux ≫ Linux Kernel Version5.13 Updaterc2
Linux ≫ Linux Kernel Version5.13 Updaterc3
Linux ≫ Linux Kernel Version5.13 Updaterc4
Linux ≫ Linux Kernel Version5.13 Updaterc5
Linux ≫ Linux Kernel Version5.13 Updaterc6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.134
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/0260916843cc74f3906acf8b6f256693e01530a2
Patch
https://git.kernel.org/stable/c/19f88ca68ccf8771276a606765239b167654f84a
Patch
https://git.kernel.org/stable/c/1cafc540b7bf1b6a5a77dc000205fe337ef6eba6
Patch
https://git.kernel.org/stable/c/95deeb29d831e2fae608439e243e7a520611e7ea
Patch
https://git.kernel.org/stable/c/9cca0c2d70149160407bda9a9446ce0c29b6e6c6
Patch
https://git.kernel.org/stable/c/b1ad283755095a4b9d1431aeb357d7df1a33d3bb
Patch
https://git.kernel.org/stable/c/d11d79e52ba080ee567cb7d7eb42a5ade60a8130
Patch
https://git.kernel.org/stable/c/db2bc3cfd2bc01621014d4f17cdfc74611f339c8
Patch