CVE-2021-46904
published 2024-02-26CVE-2021-46904: In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to claim…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.26%
17.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: hso: fix null-ptr-deref during tty device unregistration
Multiple ttys try to claim the same the minor number causing a double
unregistration of the same device. The first unregistration succeeds
but the next one results in a null-ptr-deref.
The get_free_serial_index() function returns an available minor number
but doesn't assign it immediately. The assignment is done by the caller
later. But before this assignment, calls to get_free_serial_index()
would return the same minor number.
Fix this by modifying get_free_serial_index to assign the minor number
immediately after one is found to be and rename it to obtain_minor()
to better reflect what it does. Similary, rename set_serial_by_index()
to release_minor() and modify it to free up the minor number of the
given hso_serial. Every obtain_minor() should have corresponding
release_minor() call.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.38-1 (bookworm) | linux 5.10.38-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 72dc1c096c7051a48ab1dbb12f71976656b55eb5 < a462067d7c8e6953a733bf5ade8db947b1bb5449 | a462067d7c8e6953a733bf5ade8db947b1bb5449 |
| linux | linux | >= 72dc1c096c7051a48ab1dbb12f71976656b55eb5 < 145c89c441d27696961752bf51b323f347601bee | 145c89c441d27696961752bf51b323f347601bee |
| linux | linux | >= 72dc1c096c7051a48ab1dbb12f71976656b55eb5 < caf5ac93b3b5d5fac032fc11fbea680e115421b4 | caf5ac93b3b5d5fac032fc11fbea680e115421b4 |
| linux | linux | >= 72dc1c096c7051a48ab1dbb12f71976656b55eb5 < 92028d7a31e55d53e41cff679156b9432cffcb36 | 92028d7a31e55d53e41cff679156b9432cffcb36 |
| linux | linux | >= 72dc1c096c7051a48ab1dbb12f71976656b55eb5 < 4a2933c88399c0ebc738db39bbce3ae89786d723 | 4a2933c88399c0ebc738db39bbce3ae89786d723 |
| linux | linux | >= 72dc1c096c7051a48ab1dbb12f71976656b55eb5 < dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac | dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac |
| linux | linux | >= 72dc1c096c7051a48ab1dbb12f71976656b55eb5 < 388d05f70f1ee0cac4a2068fd295072f1a44152a | 388d05f70f1ee0cac4a2068fd295072f1a44152a |
| linux | linux | >= 72dc1c096c7051a48ab1dbb12f71976656b55eb5 < 8a12f8836145ffe37e9c8733dce18c22fb668b66 | 8a12f8836145ffe37e9c8733dce18c22fb668b66 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 3.13.0-199.250 | 3.13.0-199.250 |
| linux | linux_kernel | >= 0 < 4.4.0-258.292 | 4.4.0-258.292 |
| linux | linux_kernel | >= 2.6.27 < 4.4.268 | 4.4.268 |
| linux | linux_kernel | >= 4.10.0 < 4.14.232 | 4.14.232 |
| linux | linux_kernel | >= 4.15.0 < 4.19.187 | 4.19.187 |
| linux | linux_kernel | >= 4.20.0 < 5.4.112 | 5.4.112 |
| linux | linux_kernel | >= 4.5.0 < 4.9.268 | 4.9.268 |
| linux | linux_kernel | >= 5.11.0 < 5.11.14 | 5.11.14 |
| linux | linux_kernel | >= 5.5.0 < 5.10.30 | 5.10.30 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.4MEDIUM
vendor_ubuntu6.4MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2024-08-21·CVSS 5.5
CVE-2024-22099 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux
Kernel contained a race condition, leading to a NULL pointer dereference.
An attacker could possibly use this to cause a denial of service (system
crash). (CVE-2024-22099)
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel, leading to a null pointer dereference vulnerability. A
privileged local attacker could use this to possibly cause a denial of
service (system crash). (CVE-2024-24860)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- SuperH RISC architecture;
- User-Mode Linu
OSV
linux vulnerabilities
osv·2024-08-21·CVSS 6.4
CVE-2021-37159 [MEDIUM] linux vulnerabilities
linux vulnerabilities
It was discovered that the Option USB High Speed Mobile device driver in
the Linux kernel did not properly handle error conditions. A physically
proximate attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-37159)
A security issue was discovered in the Linux kernel.
An attacker could possibly use this to compromise the system.
This update corrects flaws in the following subsystem:
- Network drivers;
(CVE-2021-46904)
GHSA
GHSA-r633-2867-crc8: In the Linux kernel, the following vulnerability has been resolved:
net: hso: fix null-ptr-deref during tty device unregistration
Multiple ttys try
ghsa_unreviewed·2024-02-26
CVE-2021-46904 [MEDIUM] CWE-476 GHSA-r633-2867-crc8: In the Linux kernel, the following vulnerability has been resolved:
net: hso: fix null-ptr-deref during tty device unregistration
Multiple ttys try
In the Linux kernel, the following vulnerability has been resolved:
net: hso: fix null-ptr-deref during tty device unregistration
Multiple ttys try to claim the same the minor number causing a double
unregistration of the same device. The first unregistration succeeds
but the next one results in a null-ptr-deref.
The get_free_serial_index() function returns an available minor number
but doesn't assign it immediately. The assignment is done by the caller
later. But before this assignment, calls to get_free_serial_index()
would return the same minor number.
Fix this by modifying get_free_serial_index to assign the minor number
immediately after one is found to be and rename it to obtain_minor()
to better reflect what it does. Similary, rename set_serial_by_index()
to release_minor() and
OSV
CVE-2021-46904: In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to
osv·2024-02-26·CVSS 5.5
CVE-2021-46904 [MEDIUM] CVE-2021-46904: In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to
In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref. The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number. Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-08-21·CVSS 6.4
CVE-2021-46904 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Option USB High Speed Mobile device driver in
the Linux kernel did not properly handle error conditions. A physically
proximate attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-37159)
A security issue was discovered in the Linux kernel.
An attacker could possibly use this to compromise the system.
This update corrects flaws in the following subsystem:
- Network drivers;
(CVE-2021-46904)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number
Red Hat
kernel: null-ptr-deref during tty device unregistration
vendor_redhat·2024-02-26·CVSS 5.5
CVE-2021-46904 [MEDIUM] CWE-476 kernel: null-ptr-deref during tty device unregistration
kernel: null-ptr-deref during tty device unregistration
In the Linux kernel, the following vulnerability has been resolved:
net: hso: fix null-ptr-deref during tty device unregistration
Multiple ttys try to claim the same the minor number causing a double
unregistration of the same device. The first unregistration succeeds
but the next one results in a null-ptr-deref.
The get_free_serial_index() function returns an available minor number
but doesn't assign it immediately. The assignment is done by the caller
later. But before this assignment, calls to get_free_serial_index()
would return the same minor number.
Fix this by modifying get_free_serial_index to assign the minor number
immediately after one is found to be and rename it to obtain_minor()
to better reflect what it does. Similary,
Debian
CVE-2021-46904: linux - In the Linux kernel, the following vulnerability has been resolved: net: hso: f...
vendor_debian·2021·CVSS 5.5
CVE-2021-46904 [MEDIUM] CVE-2021-46904: linux - In the Linux kernel, the following vulnerability has been resolved: net: hso: f...
In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref. The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number. Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modi
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601beehttps://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152ahttps://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72achttps://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601beehttps://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152ahttps://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac
2024-02-26
Published