CVE-2021-47384
published 2024-05-21CVE-2021-47384: In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field If…
PriorityP425medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
1.03%
60.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
If driver read tmp value sufficient for
(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
Also lm75[] does not serve a purpose anymore after switching to
devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
[groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.12-1 (bookworm) | linux 5.14.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= cf48d17623281c2b3185030ed23f148bd47e15de < 6cb01fe630eaffc5a2c3f7364436caddba286623 | 6cb01fe630eaffc5a2c3f7364436caddba286623 |
| linux | linux | >= cf48d17623281c2b3185030ed23f148bd47e15de < 7c4fd5de39f273626a2b0f3a446d2cc85cd47616 | 7c4fd5de39f273626a2b0f3a446d2cc85cd47616 |
| linux | linux | >= cf48d17623281c2b3185030ed23f148bd47e15de < 746011193f44f97f8784edcf8327c587946745fc | 746011193f44f97f8784edcf8327c587946745fc |
| linux | linux | >= cf48d17623281c2b3185030ed23f148bd47e15de < dd4d747ef05addab887dc8ff0d6ab9860bbcd783 | dd4d747ef05addab887dc8ff0d6ab9860bbcd783 |
| linux | linux_kernel | < 5.4.151 | 5.4.151 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.84-1 | 5.10.84-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 5.11 < 5.14.10 | 5.14.10 |
| linux | linux_kernel | >= 5.5 < 5.10.71 | 5.10.71 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
vendor_redhat·2024-05-21·CVSS 5.3
CVE-2021-47384 [MEDIUM] kernel: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
kernel: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
If driver read tmp value sufficient for
(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
Also lm75[] does not serve a purpose anymore after switching to
devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
[groeck: Dropped unnecessary continuation lines, fixed mult
Debian
CVE-2021-47384: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83...
vendor_debian·2021·CVSS 5.3
CVE-2021-47384 [MEDIUM] CVE-2021-47384: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83...
In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field If driver read tmp value sufficient for (tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7)) from device then Null pointer dereference occurs. (It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients(). The patch fixes possible NULL pointer dereference by removing lm75[]. Found by Linux Driver Verification project (linuxtesting.org). [groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]
Scope: local
bookworm: resolved (fixed in 5.14.12-1)
bullseye: resolved (fi
GHSA
GHSA-h6gr-4677-26p9: In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure fi
ghsa_unreviewed·2024-05-21
CVE-2021-47384 [MEDIUM] CWE-476 GHSA-h6gr-4677-26p9: In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure fi
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
If driver read tmp value sufficient for
(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
Also lm75[] does not serve a purpose anymore after switching to
devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
[groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]
OSV
CVE-2021-47384: In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure fie
osv·2024-05-21·CVSS 5.3
CVE-2021-47384 [MEDIUM] CVE-2021-47384: In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure fie
In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field If driver read tmp value sufficient for (tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7)) from device then Null pointer dereference occurs. (It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients(). The patch fixes possible NULL pointer dereference by removing lm75[]. Found by Linux Driver Verification project (linuxtesting.org). [groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/6cb01fe630eaffc5a2c3f7364436caddba286623https://git.kernel.org/stable/c/746011193f44f97f8784edcf8327c587946745fchttps://git.kernel.org/stable/c/7c4fd5de39f273626a2b0f3a446d2cc85cd47616https://git.kernel.org/stable/c/dd4d747ef05addab887dc8ff0d6ab9860bbcd783https://git.kernel.org/stable/c/6cb01fe630eaffc5a2c3f7364436caddba286623https://git.kernel.org/stable/c/746011193f44f97f8784edcf8327c587946745fchttps://git.kernel.org/stable/c/7c4fd5de39f273626a2b0f3a446d2cc85cd47616https://git.kernel.org/stable/c/dd4d747ef05addab887dc8ff0d6ab9860bbcd783
2024-05-21
Published