CVE-2021-46933
published 2024-02-27CVE-2021-46933: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. ffs_data_clear is indirectly called…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
15.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
ffs_data_clear is indirectly called from both ffs_fs_kill_sb and
ffs_ep0_release, so it ends up being called twice when userland closes ep0
and then unmounts f_fs.
If userland provided an eventfd along with function's USB descriptors, it
ends up calling eventfd_ctx_put as many times, causing a refcount
underflow.
NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.
Also, set epfiles to NULL right after de-allocating it, for readability.
For completeness, ffs_data_clear actually ends up being called thrice, the
last call being before the whole ffs structure gets freed, so when this
specific sequence happens there is a second underflow happening (but not
being reported):
/sys/kernel/debug/tracing# modprobe usb_f_fs
/sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter
/sys/kernel/debug/tracing# echo function > current_tracer
/sys/kernel/debug/tracing# echo 1 > tracing_on
(setup gadget, run and kill function userland process, teardown gadget)
/sys/kernel/debug/tracing# echo 0 > tracing_on
/sys/kernel/debug/tracing# cat trace
smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear ] (dump_backtrace) from [] (show_stack+0x20/0x24)
[ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c
[ 1946.458412] [] (show_stack) from [] (dump_stack+0x28/0x30)
[ 1946.470380] [] (dump_stack) from [] (__warn+0xe8/0x154)
[ 1946.482067] r5:c04a948c r4:c0a71dc8
[ 1946.490184] [] (__warn) from [] (warn_slowpath_fmt+0xa0/0xe4)
[ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04
[ 1946.517070] [] (warn_slowpath_fmt) from [] (refcount_warn_saturate+0x110/0x15c)
[ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0
[ 1946.546708] [] (refcount_warn_saturate) from [] (eventfd_ctx_put+0x48/0x74)
[ 1946.564476] [] (eventfd_ctx_put) from [] (ffs_data_clear+0xd0/0x118 [usb_f_fs])
[ 1946.582664] r5:c3
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.15.15-1 (bookworm) | linux 5.15.15-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 5e33f6fdf735cda1d4580fe6f1878da05718fe73 < f976dd7011150244a7ba820f2c331e9fb253befa | f976dd7011150244a7ba820f2c331e9fb253befa |
| linux | linux | >= 5e33f6fdf735cda1d4580fe6f1878da05718fe73 < cc8c8028c21b2a3842a1e98e99e55028df275919 | cc8c8028c21b2a3842a1e98e99e55028df275919 |
| linux | linux | >= 5e33f6fdf735cda1d4580fe6f1878da05718fe73 < 52500239e3f2d6fc77b6f58632a9fb98fe74ac09 | 52500239e3f2d6fc77b6f58632a9fb98fe74ac09 |
| linux | linux | >= 5e33f6fdf735cda1d4580fe6f1878da05718fe73 < 33f6a0cbb7772146e1c11f38028fffbfed14728b | 33f6a0cbb7772146e1c11f38028fffbfed14728b |
| linux | linux | >= 5e33f6fdf735cda1d4580fe6f1878da05718fe73 < 240fc586e83d645912accce081a48aa63a45f6ee | 240fc586e83d645912accce081a48aa63a45f6ee |
| linux | linux | >= 5e33f6fdf735cda1d4580fe6f1878da05718fe73 < 1c4ace3e6b8575745c50dca9e76e0021e697d645 | 1c4ace3e6b8575745c50dca9e76e0021e697d645 |
| linux | linux | >= 5e33f6fdf735cda1d4580fe6f1878da05718fe73 < ebef2aa29f370b5096c16020c104e393192ef684 | ebef2aa29f370b5096c16020c104e393192ef684 |
| linux | linux | >= 5e33f6fdf735cda1d4580fe6f1878da05718fe73 < b1e0887379422975f237d43d8839b751a6bcf154 | b1e0887379422975f237d43d8839b751a6bcf154 |
| linux | linux_kernel | >= 0 < 5.10.92-1 | 5.10.92-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 4.4.0-257.291 | 4.4.0-257.291 |
| linux | linux_kernel | >= 4.0.0 < 4.4.298 | 4.4.298 |
| linux | linux_kernel | >= 4.10.0 < 4.14.261 | 4.14.261 |
| linux | linux_kernel | >= 4.15.0 < 4.19.224 | 4.19.224 |
| linux | linux_kernel | >= 4.20.0 < 5.4.170 | 5.4.170 |
| linux | linux_kernel | >= 4.5.0 < 4.9.296 | 4.9.296 |
| linux | linux_kernel | >= 5.11.0 < 5.15.13 | 5.15.13 |
| linux | linux_kernel | >= 5.5.0 < 5.10.90 | 5.10.90 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2024-07-31·CVSS 5.5
CVE-2022-48619 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
It was discovered that the device input subsystem in the Linux kernel did
not properly handle the case when an event code falls outside of a bitmap.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2022-48619)
黄思聪 discovered that the NFC Controller Interface (NCI) implementation in
the Linux kernel did not properly handle certain memory allocation failure
conditions, leading to a null pointer dereference vulnerability. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-46343)
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could
OSV
CVE-2021-46933: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear
osv·2024-02-27·CVSS 5.5
CVE-2021-46933 [MEDIUM] CVE-2021-46933: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but
GHSA
GHSA-w6v7-mjp2-pwcf: In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear
ghsa_unreviewed·2024-02-27
CVE-2021-46933 [MEDIUM] CWE-416 GHSA-w6v7-mjp2-pwcf: In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
ffs_data_clear is indirectly called from both ffs_fs_kill_sb and
ffs_ep0_release, so it ends up being called twice when userland closes ep0
and then unmounts f_fs.
If userland provided an eventfd along with function's USB descriptors, it
ends up calling eventfd_ctx_put as many times, causing a refcount
underflow.
NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.
Also, set epfiles to NULL right after de-allocating it, for readability.
For completeness, ffs_data_clear actually ends up being called thrice, the
last call being before the whole ffs structure gets freed, so when this
specific sequence happens there is a second underflow happening (
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-31·CVSS 5.5
CVE-2021-47194 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the device input subsystem in the Linux kernel did
not properly handle the case when an event code falls outside of a bitmap.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2022-48619)
黄思聪 discovered that the NFC Controller Interface (NCI) implementation in
the Linux kernel did not properly handle certain memory allocation failure
conditions, leading to a null pointer dereference vulnerability. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-46343)
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through deb
Red Hat
kernel: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
vendor_redhat·2024-02-27·CVSS 5.5
CVE-2021-46933 [MEDIUM] CWE-416 kernel: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
kernel: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
ffs_data_clear is indirectly called from both ffs_fs_kill_sb and
ffs_ep0_release, so it ends up being called twice when userland closes ep0
and then unmounts f_fs.
If userland provided an eventfd along with function's USB descriptors, it
ends up calling eventfd_ctx_put as many times, causing a refcount
underflow.
NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.
Also, set epfiles to NULL right after de-allocating it, for readability.
For completeness, ffs_data_clear actually ends up being called thrice, the
last call being before the whole ffs structure gets freed, so when this
spec
Debian
CVE-2021-46933: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget...
vendor_debian·2021·CVSS 5.5
CVE-2021-46933 [MEDIUM] CVE-2021-46933: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget...
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1c4ace3e6b8575745c50dca9e76e0021e697d645https://git.kernel.org/stable/c/240fc586e83d645912accce081a48aa63a45f6eehttps://git.kernel.org/stable/c/33f6a0cbb7772146e1c11f38028fffbfed14728bhttps://git.kernel.org/stable/c/52500239e3f2d6fc77b6f58632a9fb98fe74ac09https://git.kernel.org/stable/c/b1e0887379422975f237d43d8839b751a6bcf154https://git.kernel.org/stable/c/cc8c8028c21b2a3842a1e98e99e55028df275919https://git.kernel.org/stable/c/ebef2aa29f370b5096c16020c104e393192ef684https://git.kernel.org/stable/c/f976dd7011150244a7ba820f2c331e9fb253befahttps://git.kernel.org/stable/c/1c4ace3e6b8575745c50dca9e76e0021e697d645https://git.kernel.org/stable/c/240fc586e83d645912accce081a48aa63a45f6eehttps://git.kernel.org/stable/c/33f6a0cbb7772146e1c11f38028fffbfed14728bhttps://git.kernel.org/stable/c/52500239e3f2d6fc77b6f58632a9fb98fe74ac09https://git.kernel.org/stable/c/b1e0887379422975f237d43d8839b751a6bcf154https://git.kernel.org/stable/c/cc8c8028c21b2a3842a1e98e99e55028df275919https://git.kernel.org/stable/c/ebef2aa29f370b5096c16020c104e393192ef684https://git.kernel.org/stable/c/f976dd7011150244a7ba820f2c331e9fb253befa
2024-02-27
Published