7.8

CVE-2021-47372

net: macb: fix use after free on rmmod

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix use after free on rmmod

plat_dev->dev->platform_data is released by platform_device_unregister(),
use of pclk and hclk is a use-after-free. Since device unregister won't
need a clk device we adjust the function call sequence to fix this issue.

[   31.261225] BUG: KASAN: use-after-free in macb_remove+0x77/0xc6 [macb_pci]
[   31.275563] Freed by task 306:
[   30.276782]  platform_device_release+0x25/0x80
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 4.14.249
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.209
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.150
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.70
Linux ≫ Linux Kernel Version >= 5.11 < 5.14.9
Linux ≫ Linux Kernel Version5.15 Updaterc1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.151
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/1da750d1e2140ef43d64d17f301ff6f41b45541e
Patch
https://git.kernel.org/stable/c/46670fb832ee80943715df618632ca13c2e96f2b
Patch
https://git.kernel.org/stable/c/4ad6f2d23b0f6ac0d3e5f3102a4256d1c86c90f5
Patch
https://git.kernel.org/stable/c/7721221e87d25c9840d9ca6b986dbdc410d5ce2b
Patch
https://git.kernel.org/stable/c/a7d521cc726f30b8e679a6f36d04b18a8ab3c536
Patch
https://git.kernel.org/stable/c/d82d5303c4c539db86588ffb5dc5b26c3f1513e8
Patch