CVE-2021-47258
published 2024-05-21CVE-2021-47258: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized via…
PriorityP417medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
14.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix error handling of scsi_host_alloc()
After device is initialized via device_initialize(), or its name is set via
dev_set_name(), the device has to be freed via put_device(). Otherwise
device name will be leaked because it is allocated dynamically in
dev_set_name().
Fix the leak by replacing kfree() with put_device(). Since
scsi_host_dev_release() properly handles IDA and kthread removal, remove
special-casing these from the error handling as well.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.46-1 (bookworm) | linux 5.10.46-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 1fa5ae857bb14f6046205171d98506d8112dd74e < 8958181c1663e24a13434448e7d6b96b5d04900a | 8958181c1663e24a13434448e7d6b96b5d04900a |
| linux | linux | >= 1fa5ae857bb14f6046205171d98506d8112dd74e < db08ce595dd64ea9859f7d088b51cbfc8e685c66 | db08ce595dd64ea9859f7d088b51cbfc8e685c66 |
| linux | linux | >= 1fa5ae857bb14f6046205171d98506d8112dd74e < 2dc85045ae65b9302a1d2e2ddd7ce4c030153a6a | 2dc85045ae65b9302a1d2e2ddd7ce4c030153a6a |
| linux | linux | >= 1fa5ae857bb14f6046205171d98506d8112dd74e < 79296e292d67fa7b5fb8d8c27343683e823872c8 | 79296e292d67fa7b5fb8d8c27343683e823872c8 |
| linux | linux | >= 1fa5ae857bb14f6046205171d98506d8112dd74e < 7a696ce1d5d16a33a6cd6400bbcc0339b2460e11 | 7a696ce1d5d16a33a6cd6400bbcc0339b2460e11 |
| linux | linux | >= 1fa5ae857bb14f6046205171d98506d8112dd74e < 45d83db4728127944b237c0c8248987df9d478e7 | 45d83db4728127944b237c0c8248987df9d478e7 |
| linux | linux | >= 1fa5ae857bb14f6046205171d98506d8112dd74e < 66a834d092930cf41d809c0e989b13cd6f9ca006 | 66a834d092930cf41d809c0e989b13cd6f9ca006 |
| linux | linux_kernel | < 4.9.273 | 4.9.273 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 4.10 < 4.14.237 | 4.14.237 |
| linux | linux_kernel | >= 4.15 < 4.19.195 | 4.19.195 |
| linux | linux_kernel | >= 4.20 < 5.4.126 | 5.4.126 |
| linux | linux_kernel | >= 5.11 < 5.12.11 | 5.12.11 |
| linux | linux_kernel | >= 5.5 < 5.10.44 | 5.10.44 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: scsi: core: Fix error handling of scsi_host_alloc()
vendor_redhat·2024-05-21·CVSS 5.5
CVE-2021-47258 [MEDIUM] CWE-402 kernel: scsi: core: Fix error handling of scsi_host_alloc()
kernel: scsi: core: Fix error handling of scsi_host_alloc()
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix error handling of scsi_host_alloc()
After device is initialized via device_initialize(), or its name is set via
dev_set_name(), the device has to be freed via put_device(). Otherwise
device name will be leaked because it is allocated dynamically in
dev_set_name().
Fix the leak by replacing kfree() with put_device(). Since
scsi_host_dev_release() properly handles IDA and kthread removal, remove
special-casing these from the error handling as well.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 7) - Out of support
Debian
CVE-2021-47258: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: core:...
vendor_debian·2021·CVSS 5.5
CVE-2021-47258 [MEDIUM] CVE-2021-47258: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: core:...
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized via device_initialize(), or its name is set via dev_set_name(), the device has to be freed via put_device(). Otherwise device name will be leaked because it is allocated dynamically in dev_set_name(). Fix the leak by replacing kfree() with put_device(). Since scsi_host_dev_release() properly handles IDA and kthread removal, remove special-casing these from the error handling as well.
Scope: local
bookworm: resolved (fixed in 5.10.46-1)
bullseye: resolved (fixed in 5.10.46-1)
forky: resolved (fixed in 5.10.46-1)
sid: resolved (fixed in 5.10.46-1)
trixie: resolved (fixed in 5.10.46-1)
GHSA
GHSA-g97v-hf56-5335: In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix error handling of scsi_host_alloc()
After device is initialized
ghsa_unreviewed·2024-05-21
CVE-2021-47258 [MEDIUM] CWE-401 GHSA-g97v-hf56-5335: In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix error handling of scsi_host_alloc()
After device is initialized
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix error handling of scsi_host_alloc()
After device is initialized via device_initialize(), or its name is set via
dev_set_name(), the device has to be freed via put_device(). Otherwise
device name will be leaked because it is allocated dynamically in
dev_set_name().
Fix the leak by replacing kfree() with put_device(). Since
scsi_host_dev_release() properly handles IDA and kthread removal, remove
special-casing these from the error handling as well.
OSV
CVE-2021-47258: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized vi
osv·2024-05-21·CVSS 5.5
CVE-2021-47258 [MEDIUM] CVE-2021-47258: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized vi
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized via device_initialize(), or its name is set via dev_set_name(), the device has to be freed via put_device(). Otherwise device name will be leaked because it is allocated dynamically in dev_set_name(). Fix the leak by replacing kfree() with put_device(). Since scsi_host_dev_release() properly handles IDA and kthread removal, remove special-casing these from the error handling as well.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2dc85045ae65b9302a1d2e2ddd7ce4c030153a6ahttps://git.kernel.org/stable/c/45d83db4728127944b237c0c8248987df9d478e7https://git.kernel.org/stable/c/66a834d092930cf41d809c0e989b13cd6f9ca006https://git.kernel.org/stable/c/79296e292d67fa7b5fb8d8c27343683e823872c8https://git.kernel.org/stable/c/7a696ce1d5d16a33a6cd6400bbcc0339b2460e11https://git.kernel.org/stable/c/8958181c1663e24a13434448e7d6b96b5d04900ahttps://git.kernel.org/stable/c/db08ce595dd64ea9859f7d088b51cbfc8e685c66https://git.kernel.org/stable/c/2dc85045ae65b9302a1d2e2ddd7ce4c030153a6ahttps://git.kernel.org/stable/c/45d83db4728127944b237c0c8248987df9d478e7https://git.kernel.org/stable/c/66a834d092930cf41d809c0e989b13cd6f9ca006https://git.kernel.org/stable/c/79296e292d67fa7b5fb8d8c27343683e823872c8https://git.kernel.org/stable/c/7a696ce1d5d16a33a6cd6400bbcc0339b2460e11https://git.kernel.org/stable/c/8958181c1663e24a13434448e7d6b96b5d04900ahttps://git.kernel.org/stable/c/db08ce595dd64ea9859f7d088b51cbfc8e685c66
2024-05-21
Published