CVE-2021-47456

can: peak_pci: peak_pci_remove(): fix UAF

Severity Score

8.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

can: peak_pci: peak_pci_remove(): fix UAF

When remove the module peek_pci, referencing 'chan' again after
releasing 'dev' will cause UAF.

Fix this by releasing 'dev' later.

The following log reveals it:

[ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci]
[ 35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537
[ 35.965513 ] Call Trace:
[ 35.965718 ] dump_stack_lvl+0xa8/0xd1
[ 35.966028 ] print_address_description+0x87/0x3b0
[ 35.966420 ] kasan_report+0x172/0x1c0
[ 35.966725 ] ? peak_pci_remove+0x16f/0x270 [peak_pci]
[ 35.967137 ] ? trace_irq_enable_rcuidle+0x10/0x170
[ 35.967529 ] ? peak_pci_remove+0x16f/0x270 [peak_pci]
[ 35.967945 ] __asan_report_load8_noabort+0x14/0x20
[ 35.968346 ] peak_pci_remove+0x16f/0x270 [peak_pci]
[ 35.968752 ] pci_device_remove+0xa9/0x250

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: pico_pci: pico_pci_remove(): arreglar UAF Cuando se elimina el módulo peek_pci, hacer referencia a 'chan' nuevamente después de liberar 'dev' causará UAF. Solucione este problema lanzando 'dev' más tarde. El siguiente registro lo revela: [35.961814] ERROR: KASAN: uso después de liberar en pico_pci_remove+0x16f/0x270 [peak_pci] [35.963414] Lectura de tamaño 8 en addr ffff888136998ee8 por tarea modprobe/5537 [35.965513] Seguimiento de llamadas: [3 5.965718 ] dump_stack_lvl+0xa8/0xd1 [35.966028] print_address_description+0x87/0x3b0 [35.966420] kasan_report+0x172/0x1c0 [35.966725]? pico_pci_remove+0x16f/0x270 [pico_pci] [35.967137]? trace_irq_enable_rcuidle+0x10/0x170 [35.967529]? pico_pci_remove+0x16f/0x270 [pico_pci] [ 35.967945 ] __asan_report_load8_noabort+0x14/0x20 [ 35.968346 ] pico_pci_remove+0x16f/0x270 [pico_pci] [ 35.968752 ] ve+0xa9/0x250

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-05-21 CVE Reserved
2024-05-22 CVE Published
2024-05-22 EPSS Updated
2024-11-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-416: Use After Free
CWE-467: Use of sizeof() on a Pointer Type

CAPEC

References (11)

URL	Tag	Source
https://git.kernel.org/stable/c/e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/1c616528ba4aeb1125a06b407572ab7b56acae38	2021-10-27
https://git.kernel.org/stable/c/447d44cd2f67a20b596ede3ca3cd67086dfd9ca9	2021-10-27
https://git.kernel.org/stable/c/34914971bb3244db4ce2be44e9438a9b30c56250	2021-10-27
https://git.kernel.org/stable/c/adbda14730aacce41c0d3596415aa39ad63eafd9	2021-10-27
https://git.kernel.org/stable/c/1248582e47a9f7ce0ecd156c39fc61f8b6aa3699	2021-10-27
https://git.kernel.org/stable/c/28f28e4bc3a5e0051faa963f10b778ab38c1db69	2021-10-27
https://git.kernel.org/stable/c/0e5afdc2315b0737edcf55bede4ee1640d2d464d	2021-10-27
https://git.kernel.org/stable/c/949fe9b35570361bc6ee2652f89a0561b26eec98	2021-10-17

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2021-47456	2024-07-08
https://bugzilla.redhat.com/show_bug.cgi?id=2282902	2024-07-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.4 < 4.4.290 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.4 < 4.4.290"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.4 < 4.9.288 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.4 < 4.9.288"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.4 < 4.14.253 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.4 < 4.14.253"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.4 < 4.19.214 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.4 < 4.19.214"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.4 < 5.4.156 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.4 < 5.4.156"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.4 < 5.10.76 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.4 < 5.10.76"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.4 < 5.14.15 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.4 < 5.14.15"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.4 < 5.15 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.4 < 5.15"		en		Affected