CVE-2021-47334
published 2024-05-21CVE-2021-47334: In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one, it calls…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.28%
20.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
misc/libmasm/module: Fix two use after free in ibmasm_init_one
In ibmasm_init_one, it calls ibmasm_init_remote_input_dev().
Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are
allocated by input_allocate_device(), and assigned to
sp->remote.mouse_dev and sp->remote.keybd_dev respectively.
In the err_free_devices error branch of ibmasm_init_one,
mouse_dev and keybd_dev are freed by input_free_device(), and return
error. Then the execution runs into error_send_message error branch
of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called
to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.
My patch add a "error_init_remote" label to handle the error of
ibmasm_init_remote_input_dev(), to avoid the uaf bugs.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.6-1 (bookworm) | linux 5.14.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < 1512e7dc5eb08b7d92a12e2bfcd9cb8c4a1ec069 | 1512e7dc5eb08b7d92a12e2bfcd9cb8c4a1ec069 |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < 29ba8e2ba89ee2862a26d91204dd5fe77ceee25a | 29ba8e2ba89ee2862a26d91204dd5fe77ceee25a |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < 5b06ca113bf197aab2ab61288f42506e0049fbab | 5b06ca113bf197aab2ab61288f42506e0049fbab |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < 481a76d4749ee3a27f902ba213fdcbb4bb39720e | 481a76d4749ee3a27f902ba213fdcbb4bb39720e |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < 38660031e80eaa6cc9370b031c180612f414b00d | 38660031e80eaa6cc9370b031c180612f414b00d |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < b9c87ce3bc6331f82811a8cf8e930423c22523a3 | b9c87ce3bc6331f82811a8cf8e930423c22523a3 |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < ef1067d2baa847d53c9988510d99fb494de4d12c | ef1067d2baa847d53c9988510d99fb494de4d12c |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < a7268e8a227d5a4f0bd1584f556246b0224ab274 | a7268e8a227d5a4f0bd1584f556246b0224ab274 |
| linux | linux | >= 736ce43295682d060f2b93624b4a339f9af6aab1 < 7272b591c4cb9327c43443f67b8fbae7657dd9ae | 7272b591c4cb9327c43443f67b8fbae7657dd9ae |
| linux | linux_kernel | < 4.4.276 | 4.4.276 |
| linux | linux_kernel | >= 0 < 5.10.70-1 | 5.10.70-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 4.10 < 4.14.240 | 4.14.240 |
| linux | linux_kernel | >= 4.15 < 4.19.198 | 4.19.198 |
| linux | linux_kernel | >= 4.20 < 5.4.134 | 5.4.134 |
| linux | linux_kernel | >= 4.5 < 4.9.276 | 4.9.276 |
| linux | linux_kernel | >= 5.11 < 5.12.19 | 5.12.19 |
| linux | linux_kernel | >= 5.13 < 5.13.4 | 5.13.4 |
| linux | linux_kernel | >= 5.5 < 5.10.52 | 5.10.52 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-chv3-xxv6-8hvr: In the Linux kernel, the following vulnerability has been resolved:
misc/libmasm/module: Fix two use after free in ibmasm_init_one
In ibmasm_init_on
ghsa_unreviewed·2024-05-21
CVE-2021-47334 [HIGH] CWE-416 GHSA-chv3-xxv6-8hvr: In the Linux kernel, the following vulnerability has been resolved:
misc/libmasm/module: Fix two use after free in ibmasm_init_one
In ibmasm_init_on
In the Linux kernel, the following vulnerability has been resolved:
misc/libmasm/module: Fix two use after free in ibmasm_init_one
In ibmasm_init_one, it calls ibmasm_init_remote_input_dev().
Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are
allocated by input_allocate_device(), and assigned to
sp->remote.mouse_dev and sp->remote.keybd_dev respectively.
In the err_free_devices error branch of ibmasm_init_one,
mouse_dev and keybd_dev are freed by input_free_device(), and return
error. Then the execution runs into error_send_message error branch
of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called
to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.
My patch add a "error_init_remote" label to handle the error of
ibmasm_init_remote_input_de
OSV
CVE-2021-47334: In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one,
osv·2024-05-21·CVSS 7.8
CVE-2021-47334 [HIGH] CVE-2021-47334: In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one,
In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are allocated by input_allocate_device(), and assigned to sp->remote.mouse_dev and sp->remote.keybd_dev respectively. In the err_free_devices error branch of ibmasm_init_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_send_message error branch of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. My patch add a "error_init_remote" label to handle the error of ibmasm_init_remote_input_dev(),
Red Hat
kernel: misc/libmasm/module: Fix two use after free in ibmasm_init_one
vendor_redhat·2024-05-21·CVSS 7.8
CVE-2021-47334 [HIGH] CWE-416 kernel: misc/libmasm/module: Fix two use after free in ibmasm_init_one
kernel: misc/libmasm/module: Fix two use after free in ibmasm_init_one
In the Linux kernel, the following vulnerability has been resolved:
misc/libmasm/module: Fix two use after free in ibmasm_init_one
In ibmasm_init_one, it calls ibmasm_init_remote_input_dev().
Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are
allocated by input_allocate_device(), and assigned to
sp->remote.mouse_dev and sp->remote.keybd_dev respectively.
In the err_free_devices error branch of ibmasm_init_one,
mouse_dev and keybd_dev are freed by input_free_device(), and return
error. Then the execution runs into error_send_message error branch
of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called
to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.
My patch add a "error_i
Debian
CVE-2021-47334: linux - In the Linux kernel, the following vulnerability has been resolved: misc/libmas...
vendor_debian·2021·CVSS 7.8
CVE-2021-47334 [HIGH] CVE-2021-47334: linux - In the Linux kernel, the following vulnerability has been resolved: misc/libmas...
In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are allocated by input_allocate_device(), and assigned to sp->remote.mouse_dev and sp->remote.keybd_dev respectively. In the err_free_devices error branch of ibmasm_init_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_send_message error branch of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. My patch add a "error_init_remote" label to handle the error of ibmasm_init_remote_input_dev(),
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1512e7dc5eb08b7d92a12e2bfcd9cb8c4a1ec069https://git.kernel.org/stable/c/29ba8e2ba89ee2862a26d91204dd5fe77ceee25ahttps://git.kernel.org/stable/c/38660031e80eaa6cc9370b031c180612f414b00dhttps://git.kernel.org/stable/c/481a76d4749ee3a27f902ba213fdcbb4bb39720ehttps://git.kernel.org/stable/c/5b06ca113bf197aab2ab61288f42506e0049fbabhttps://git.kernel.org/stable/c/7272b591c4cb9327c43443f67b8fbae7657dd9aehttps://git.kernel.org/stable/c/a7268e8a227d5a4f0bd1584f556246b0224ab274https://git.kernel.org/stable/c/b9c87ce3bc6331f82811a8cf8e930423c22523a3https://git.kernel.org/stable/c/ef1067d2baa847d53c9988510d99fb494de4d12chttps://git.kernel.org/stable/c/1512e7dc5eb08b7d92a12e2bfcd9cb8c4a1ec069https://git.kernel.org/stable/c/29ba8e2ba89ee2862a26d91204dd5fe77ceee25ahttps://git.kernel.org/stable/c/38660031e80eaa6cc9370b031c180612f414b00dhttps://git.kernel.org/stable/c/481a76d4749ee3a27f902ba213fdcbb4bb39720ehttps://git.kernel.org/stable/c/5b06ca113bf197aab2ab61288f42506e0049fbabhttps://git.kernel.org/stable/c/7272b591c4cb9327c43443f67b8fbae7657dd9aehttps://git.kernel.org/stable/c/a7268e8a227d5a4f0bd1584f556246b0224ab274https://git.kernel.org/stable/c/b9c87ce3bc6331f82811a8cf8e930423c22523a3https://git.kernel.org/stable/c/ef1067d2baa847d53c9988510d99fb494de4d12c
2024-05-21
Published