5.5

CVE-2021-47305

dma-buf/sync_file: Don't leak fences on merge failure

In the Linux kernel, the following vulnerability has been resolved:

dma-buf/sync_file: Don't leak fences on merge failure

Each add_fence() call does a dma_fence_get() on the relevant fence.  In
the error path, we weren't calling dma_fence_put() so all those fences
got leaked.  Also, in the krealloc_array failure case, we weren't
freeing the fences array.  Instead, ensure that i and fences are always
zero-initialized and dma_fence_put() all the fences and kfree(fences) on
every error path.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.9 < 4.14.241
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.199
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.135
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.53
Linux ≫ Linux Kernel Version >= 5.11 < 5.13.5
Linux ≫ Linux Kernel Version5.14 Updaterc1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.146
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

https://git.kernel.org/stable/c/0d514185ae792d3a1903c8e1a83899aa996705ce
Patch
https://git.kernel.org/stable/c/19edcd97727aae9362444a859a24d99a8730cb27
Patch
https://git.kernel.org/stable/c/19f51c2529339280d2c8c6427cd3e21ddf1ac3f8
Patch
https://git.kernel.org/stable/c/41f45e91c92c8480242ea448d54e28c753b13902
Patch
https://git.kernel.org/stable/c/e0355a0ad31a1d677b2a4514206de4902bd550e8
Patch
https://git.kernel.org/stable/c/ffe000217c5068c5da07ccb1c0f8cce7ad767435
Patch