CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-47520 – can: pch_can: pch_can_rx_normal: fix use after free
https://notcve.org/view.php?id=CVE-2021-47520
In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_skb(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is dereferenced just after the call netif_receive_skb(skb). Reordering the lines solves the issue. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: pch_can: pch_can_rx_normal: corregir el use after free después de llamar a netif_receive_skb(skb), desreferenciar skb no es seguro. Especialmente, el can_frame cf que alias la memoria skb se desreferencia justo después de la llamada netif_receive_skb(skb). Reordenar las líneas resuelve el problema. • https://git.kernel.org/stable/c/b21d18b51b31a24d17f883b678432fbdee3d5675 https://git.kernel.org/stable/c/bafe343a885c70dddf358379cf0b2a1c07355d8d https://git.kernel.org/stable/c/3a3c46e2eff0577454860a203be1a8295f4acb76 https://git.kernel.org/stable/c/affbad02bf80380a7403885b9fe4a1587d1bb4f3 https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa https://git.kernel.org/stable/c/abb4eff3dcd2e583060082a18a8dbf31f02689d4 https://git.kernel.org/stable/c/703dde112021c93d6e89443c070e7dbd4dea612e https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47519 – can: m_can: m_can_read_fifo: fix memory leak in error branch
https://notcve.org/view.php?id=CVE-2021-47519
In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_read_fifo: fix memory leak in error branch In m_can_read_fifo(), if the second call to m_can_fifo_read() fails, the function jump to the out_fail label and returns without calling m_can_receive_skb(). This means that the skb previously allocated by alloc_can_skb() is not freed. In other terms, this is a memory leak. This patch adds a goto label to destroy the skb if an error occurs. Issue was found with GCC -fanalyzer, please follow the link below for details. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: m_can: m_can_read_fifo: corrige la pérdida de memoria en la rama de error En m_can_read_fifo(), si la segunda llamada a m_can_fifo_read() falla, la función salta a la etiqueta out_fail y regresa sin llamar m_can_receive_skb(). Esto significa que el skb previamente asignado por alloc_can_skb() no se libera. • https://git.kernel.org/stable/c/e39381770ec9ca3c51d8b9bd9cc6e01d78ea974a https://git.kernel.org/stable/c/75a422165477dd12d2d20aa7c9ee7c9a281c9908 https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2021-47518 – nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
https://notcve.org/view.php?id=CVE-2021-47518
In the Linux kernel, the following vulnerability has been resolved: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done The done() netlink callback nfc_genl_dump_ses_done() should check if received argument is non-NULL, because its allocation could fail earlier in dumpit() (nfc_genl_dump_ses()). En el kernel de Linux, se resolvió la siguiente vulnerabilidad: nfc: corrige la posible deref del puntero NULL en nfc_genl_dump_ses_done La devolución de llamada de netlink done() nfc_genl_dump_ses_done() debe verificar si el argumento recibido no es NULL, porque su asignación podría fallar antes en dumpit() (nfc_genl_dump_ses()). • https://git.kernel.org/stable/c/ac22ac466a659f1b2e02a2e2ee23fc5c42da2c95 https://git.kernel.org/stable/c/87cdb8789c38e44ae5454aafe277997c950d00ed https://git.kernel.org/stable/c/69bb79a8f5bb9f436b6f1434ca9742591b7bbe18 https://git.kernel.org/stable/c/811a7576747760bcaf60502f096d1e6e91d566fa https://git.kernel.org/stable/c/3b861a40325eac9c4c13b6c53874ad90617e944d https://git.kernel.org/stable/c/48fcd08fdbe05e35b650a252ec2a2d96057a1c7a https://git.kernel.org/stable/c/83ea620a1be840bf05089a5061fb8323ca42f38c https://git.kernel.org/stable/c/fae9705d281091254d4a81fa2da9d2234 • CWE-476: NULL Pointer Dereference •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47517 – ethtool: do not perform operations on net devices being unregistered
https://notcve.org/view.php?id=CVE-2021-47517
In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operations on net devices being unregistered There is a short period between a net device starts to be unregistered and when it is actually gone. In that time frame ethtool operations could still be performed, which might end up in unwanted or undefined behaviours[1]. Do not allow ethtool operations after a net device starts its unregistration. This patch targets the netlink part as the ioctl one isn't affected: the reference to the net device is taken and the operation is executed within an rtnl lock section and the net device won't be found after unregister. [1] For example adding Tx queues after unregister ends up in NULL pointer exceptions and UaFs, such as: BUG: KASAN: use-after-free in kobject_get+0x14/0x90 Read of size 1 at addr ffff88801961248c by task ethtool/755 CPU: 0 PID: 755 Comm: ethtool Not tainted 5.15.0-rc6+ #778 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/014 Call Trace: dump_stack_lvl+0x57/0x72 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x7f/0x11b kobject_get+0x14/0x90 kobject_add_internal+0x3d1/0x450 kobject_init_and_add+0xba/0xf0 netdev_queue_update_kobjects+0xcf/0x200 netif_set_real_num_tx_queues+0xb4/0x310 veth_set_channels+0x1c3/0x550 ethnl_set_channels+0x524/0x610 En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ethtool: no realiza operaciones en dispositivos de red que se están dando de baja. Hay un breve período entre que un dispositivo de red comienza a darse de baja y cuando realmente desaparece. En ese período aún se podrían realizar operaciones de ethtool, lo que podría terminar en comportamientos no deseados o indefinidos[1]. • https://git.kernel.org/stable/c/041b1c5d4a53e97fc9e029ae32469552ca12cb9b https://git.kernel.org/stable/c/7c26da3be1e9843a15b5318f90db8a564479d2ac https://git.kernel.org/stable/c/cfd719f04267108f5f5bf802b9d7de69e99a99f9 https://git.kernel.org/stable/c/dde91ccfa25fd58f64c397d91b81a4b393100ffa •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-47516 – nfp: Fix memory leak in nfp_cpp_area_cache_add()
https://notcve.org/view.php?id=CVE-2021-47516
In the Linux kernel, the following vulnerability has been resolved: nfp: Fix memory leak in nfp_cpp_area_cache_add() In line 800 (#1), nfp_cpp_area_alloc() allocates and initializes a CPP area structure. But in line 807 (#2), when the cache is allocated failed, this CPP area structure is not freed, which will result in memory leak. We can fix it by freeing the CPP area when the cache is allocated failed (#2). 792 int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size) 793 { 794 struct nfp_cpp_area_cache *cache; 795 struct nfp_cpp_area *area; 800 area = nfp_cpp_area_alloc(cpp, NFP_CPP_ID(7, NFP_CPP_ACTION_RW, 0), 801 0, size); // #1: allocates and initializes 802 if (!area) 803 return -ENOMEM; 805 cache = kzalloc(sizeof(*cache), GFP_KERNEL); 806 if (!cache) 807 return -ENOMEM; // #2: missing free 817 return 0; 818 } En el kernel de Linux, se resolvió la siguiente vulnerabilidad: nfp: corrige la pérdida de memoria en nfp_cpp_area_cache_add() En la línea 800 (#1), nfp_cpp_area_alloc() asigna e inicializa una estructura de área CPP. Pero en la línea 807 (#2), cuando falla la asignación de caché, esta estructura de área CPP no se libera, lo que resultará en una pérdida de memoria. • https://git.kernel.org/stable/c/4cb584e0ee7df70fd0376aee60cf701855ea8c81 https://git.kernel.org/stable/c/3e93abcdcec0436fbf0b6a88ae806902426895a2 https://git.kernel.org/stable/c/eb51f639ef3fd5498b7def290ed8681b6aadd9a7 https://git.kernel.org/stable/c/2e0e072e62fdaf7816220af08e05c020f0fcb77a https://git.kernel.org/stable/c/484069b5de9d223cc1c64c6f80389a99cfef51f1 https://git.kernel.org/stable/c/f707820c09239d6f67699d9b2ff57863cc7905b0 https://git.kernel.org/stable/c/c56c96303e9289cc34716b1179597b6f470833de • CWE-401: Missing Release of Memory after Effective Lifetime •