7.8

CVE-2021-47361

mcb: fix error handling in mcb_alloc_bus()

In the Linux kernel, the following vulnerability has been resolved:

mcb: fix error handling in mcb_alloc_bus()

There are two bugs:
1) If ida_simple_get() fails then this code calls put_device(carrier)
   but we haven't yet called get_device(carrier) and probably that
   leads to a use after free.
2) After device_initialize() then we need to use put_device() to
   release the bus.  This will free the internal resources tied to the
   device and call mcb_free_bus() which will free the rest.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.7 < 4.9.285
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.249
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.209
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.150
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.70
Linux ≫ Linux Kernel Version >= 5.11 < 5.14.9
Linux ≫ Linux Kernel Version5.15 Updaterc1
Linux ≫ Linux Kernel Version5.15 Updaterc2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.151
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/115b07d9f47e3996430b8f2007edd9768e1f807f
Patch
https://git.kernel.org/stable/c/25a1433216489de4abc889910f744e952cb6dbae
Patch
https://git.kernel.org/stable/c/66f74ba9be9daf9c47fface6af3677f602774f6b
Patch
https://git.kernel.org/stable/c/7751f609eadf36b1f53712bae430019c53a16eb0
Patch
https://git.kernel.org/stable/c/8a558261fa57a6deefb0925ab1829f698b194aea
Patch
https://git.kernel.org/stable/c/91e4ad05bf18322b5921d1a6c9b603f6eb1694f0
Patch
https://git.kernel.org/stable/c/9fc198f415dee070a1de957bb5bf5921d8df3499
Patch