cbcvebase.
CVE-2021-47325
published 2024-05-21

CVE-2021-47325: In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation The reference…

PriorityP417medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.0th percentile
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation The reference counting issue happens in several exception handling paths of arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the function forgets to decrease the refcount of "smmu" increased by arm_smmu_rpm_get(), causing a refcount leak. Fix this issue by jumping to "out" label when those error scenarios occur.

Affected

15 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.14.6-1 (bookworm)linux 5.14.6-1 (bookworm)
linuxlinux——
linuxlinux>= d4a44f0750bb9bf7c44c22444a482756b2344a79 < b11220803ad14a2a880cc06d8e01fe2548cc85b0b11220803ad14a2a880cc06d8e01fe2548cc85b0
linuxlinux>= d4a44f0750bb9bf7c44c22444a482756b2344a79 < 43d1aaa1965f9b58035196dac49b1e1e6c9c25eb43d1aaa1965f9b58035196dac49b1e1e6c9c25eb
linuxlinux>= d4a44f0750bb9bf7c44c22444a482756b2344a79 < 0f0c5ea09139777d90729d408b807021f2ea64920f0c5ea09139777d90729d408b807021f2ea6492
linuxlinux>= d4a44f0750bb9bf7c44c22444a482756b2344a79 < 5f9741a9a91f25c89e04b408cd61e3ab050ce24b5f9741a9a91f25c89e04b408cd61e3ab050ce24b
linuxlinux>= d4a44f0750bb9bf7c44c22444a482756b2344a79 < 7c8f176d6a3fa18aa0f8875da6f7c672ed2a85547c8f176d6a3fa18aa0f8875da6f7c672ed2a8554
linuxlinux_kernel< 5.4.1345.4.134
linuxlinux_kernel>= 0 < 5.10.70-15.10.70-1
linuxlinux_kernel>= 0 < 5.14.6-15.14.6-1
linuxlinux_kernel>= 0 < 5.14.6-15.14.6-1
linuxlinux_kernel>= 0 < 5.14.6-15.14.6-1
linuxlinux_kernel>= 5.11 < 5.12.195.12.19
linuxlinux_kernel>= 5.13 < 5.13.45.13.4
linuxlinux_kernel>= 5.5 < 5.10.525.10.52

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.