CVE-2021-46904
net: hso: fix null-ptr-deref during tty device unregistration
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
net: hso: fix null-ptr-deref during tty device unregistration
Multiple ttys try to claim the same the minor number causing a double
unregistration of the same device. The first unregistration succeeds
but the next one results in a null-ptr-deref.
The get_free_serial_index() function returns an available minor number
but doesn't assign it immediately. The assignment is done by the caller
later. But before this assignment, calls to get_free_serial_index()
would return the same minor number.
Fix this by modifying get_free_serial_index to assign the minor number
immediately after one is found to be and rename it to obtain_minor()
to better reflect what it does. Similary, rename set_serial_by_index()
to release_minor() and modify it to free up the minor number of the
given hso_serial. Every obtain_minor() should have corresponding
release_minor() call.
En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net: hso: corrige null-ptr-deref durante la cancelación del registro del dispositivo tty. Múltiples ttys intentan reclamar el mismo número menor, lo que provoca una doble cancelación del registro del mismo dispositivo. La primera cancelación del registro se realiza correctamente, pero la siguiente genera un null-ptr-deref. La función get_free_serial_index() devuelve un número menor disponible pero no lo asigna inmediatamente. La asignación la realiza la persona que llama más tarde. Pero antes de esta asignación, las llamadas a get_free_serial_index() devolverían el mismo número menor. Solucione este problema modificando get_free_serial_index para asignar el número menor inmediatamente después de que se encuentre uno y cámbiele el nombre a get_minor() para reflejar mejor lo que hace. De manera similar, cambie el nombre de set_serial_by_index() a release_minor() y modifíquelo para liberar el número menor del hso_serial dado. Cada get_minor() debe tener la llamada release_minor() correspondiente.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-25 CVE Reserved
- 2024-02-25 CVE Published
- 2024-04-21 EPSS Updated
- 2024-12-19 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/72dc1c096c7051a48ab1dbb12f71976656b55eb5 | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.27 < 4.4.268 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.27 < 4.4.268" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.27 < 4.9.268 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.27 < 4.9.268" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.27 < 4.14.232 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.27 < 4.14.232" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.27 < 4.19.187 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.27 < 4.19.187" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.27 < 5.4.112 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.27 < 5.4.112" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.27 < 5.10.30 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.27 < 5.10.30" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.27 < 5.11.14 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.27 < 5.11.14" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.27 < 5.12 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.27 < 5.12" | en |
Affected
| ||||||