cbcvebase.
CVE-2021-47483
published 2024-05-22

CVE-2021-47483: In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In…

PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
13.8th percentile
In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnode->block' will be freed again in regcache_rbtree_exit(), KASAN will report double-free as follows: BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/0x1310 __regmap_init+0x3151/0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 really_probe+0x285/0xc30 To fix this, moving up the assignment of rbnode->block to immediately after the reallocation has succeeded so that the data structure stays valid even if the second reallocation fails.

Affected

24 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.15.3-1 (bookworm)linux 5.15.3-1 (bookworm)
linuxlinux
linuxlinux>= 3f4ff561bc88b074d5e868dde4012d89cbb06c87 < e72dce9afbdbfa70d9b44f5908a50ff6c4858999e72dce9afbdbfa70d9b44f5908a50ff6c4858999
linuxlinux>= 3f4ff561bc88b074d5e868dde4012d89cbb06c87 < fc081477b47dfc3a6cb50a96087fc29674013fc2fc081477b47dfc3a6cb50a96087fc29674013fc2
linuxlinux>= 3f4ff561bc88b074d5e868dde4012d89cbb06c87 < 758ced2c3878ff789801e6fee808e185c5cf08d6758ced2c3878ff789801e6fee808e185c5cf08d6
linuxlinux>= 3f4ff561bc88b074d5e868dde4012d89cbb06c87 < 3dae1a4eced3ee733d7222e69b8a55caf2d610913dae1a4eced3ee733d7222e69b8a55caf2d61091
linuxlinux>= 3f4ff561bc88b074d5e868dde4012d89cbb06c87 < 1cead23c1c0bc766dacb900a3b0269f651ad596f1cead23c1c0bc766dacb900a3b0269f651ad596f
linuxlinux>= 3f4ff561bc88b074d5e868dde4012d89cbb06c87 < 36e911a16b377bde0ad91a8c679069d0d310b1a636e911a16b377bde0ad91a8c679069d0d310b1a6
linuxlinux>= 3f4ff561bc88b074d5e868dde4012d89cbb06c87 < 50cc1462a668dc62949a1127388bc3af785ce04750cc1462a668dc62949a1127388bc3af785ce047
linuxlinux>= 3f4ff561bc88b074d5e868dde4012d89cbb06c87 < 55e6d8037805b3400096d621091dfbf713f97e8355e6d8037805b3400096d621091dfbf713f97e83
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.84-15.10.84-1
linuxlinux_kernel>= 0 < 5.15.3-15.15.3-1
linuxlinux_kernel>= 0 < 5.15.3-15.15.3-1
linuxlinux_kernel>= 0 < 5.15.3-15.15.3-1
linuxlinux_kernel>= 0 < 3.13.0-205.2563.13.0-205.256
linuxlinux_kernel>= 0 < 4.4.0-267.3014.4.0-267.301
linuxlinux_kernel>= 3.12 < 4.4.2914.4.291
linuxlinux_kernel>= 4.10 < 4.14.2544.14.254
linuxlinux_kernel>= 4.15 < 4.19.2154.19.215
linuxlinux_kernel>= 4.20 < 5.4.1575.4.157
linuxlinux_kernel>= 4.5 < 4.9.2894.9.289
linuxlinux_kernel>= 5.11 < 5.14.165.14.16
linuxlinux_kernel>= 5.5 < 5.10.775.10.77

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.