Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-47053 State: PUBLISHED Published: 2024-02-28T08:13:54.711Z Last Updated: 2025-05-04T07:03:14.780Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Fix memory leak of pad It appears there are several failure return paths that don't seem to be free'ing pad. Fix these. Addresses-Coverity: ("Resource leak") Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2c67a9333da9d0a3b87310e0d116b7c9070c7b00 - https://git.kernel.org/stable/c/c633e025bd04f54d7b33331cfcdb71354b08ce59 - https://git.kernel.org/stable/c/d3d702084d125689edb2b939
.kernel.org/stable/c/c633e025bd04f54d7b33331cfcdb71354b08ce59 - https://git.kernel.org/stable/c/d3d702084d125689edb2b9395c707e09b471352e - https://git.kernel.org/stable/c/50274b01ac1689b1a3f6bc4b5b3dbf361a55dd3a
CVE ID: CVE-2021-47054 State: PUBLISHED Published: 2024-02-29T22:37:29.140Z Last Updated: 2025-05-04T07:03:15.858Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bus: qcom: Put child node before return Put child node before return to fix potential reference count leak. Generally, the reference count of child is incremented and decremented automatically in the macro for_each_available_child_of_node() and should be decremented manually if the loop is broken in loop body. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a6191e91c10e50bd51db65a00e03d02b6b0cf8c
richment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a6191e91c10e50bd51db65a00e03d02b6b0cf8c4 - https://git.kernel.org/stable/c/94810fc52925eb122a922df7f9966cf3f4ba7391 - https://git.kernel.org/stable/c/a399dd80e697a02cfb23e2fc09b87849994043d9 - https://git.kernel.org/stable/c/3a76ec28824c01b57aa1f0927841d75e4f167cb8 - https://git.kernel.org/stable/c/00f6abd3509b1d70d0ab0fbe65ce5685cebed8be - https://git.kernel.org/stable/c/6b68c03dfc79cd95a58dfd03f91f6e82829a1b0c - https://git.kernel.org/stable/c/c6f8e0dc8da1cd78d640dee392071cc2326ec1b2 - https://git.kernel.org/stable/c/ac6ad7c2a862d682bb584a4bc904d89fa7721af8
CVE ID: CVE-2021-47055 State: PUBLISHED Published: 2024-02-29T22:37:30.071Z Last Updated: 2025-05-04T12:40:58.929Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: require write permissions for locking and badblock ioctls MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require write permission. Depending on the hardware MEMLOCK might even be write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK is always write-once. MEMSETBADBLOCK modifies the bad block table. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f4d28d8b9b0e7c
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f4d28d8b9b0e7c4ae04214b8d7e0b0466ec6bcaf - https://git.kernel.org/stable/c/9625b00cac6630479c0ff4b9fafa88bee636e1f0 - https://git.kernel.org/stable/c/f73b29819c6314c0ba8b7d5892dfb03487424bee - https://git.kernel.org/stable/c/75ed985bd6c8ac1d4e673e93ea9d96c9908c1d37 - https://git.kernel.org/stable/c/5880afefe0cb9b2d5e801816acd58bfe91a96981 - https://git.kernel.org/stable/c/7b6552719c0ccbbea29dde4be141da54fdb5877e - https://git.kernel.org/stable/c/077259f5e777c3c8821f6b41dee709fcda27306b - https://git.kernel.org/stable/c/a08799d3e8c8088640956237c183f83463c39668 - https://git.kernel.org/sta
dee709fcda27306b - https://git.kernel.org/stable/c/a08799d3e8c8088640956237c183f83463c39668 - https://git.kernel.org/stable/c/1e97743fd180981bef5f01402342bb54bf1c6366
CVE ID: CVE-2021-47056 State: PUBLISHED Published: 2024-02-29T22:37:31.086Z Last Updated: 2025-05-04T07:03:18.175Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the vf2pf_lock is initialized in adf_dev_init(), which can fail and when it fail, the vf2pf_lock is either not initialized or destroyed, a subsequent use of vf2pf_lock will cause issue. To fix this issue, only set this flag if adf_dev_init() returns 0. [ 7.178404] B
ent use of vf2pf_lock will cause issue. To fix this issue, only set this flag if adf_dev_init() returns 0. [ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0 [ 7.180345] Call Trace: [ 7.182576] mutex_lock+0xc9/0xd0 [ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat] [ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat] [ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat] [ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f4c4e07140687f42bfa40e091bb4a55d7960ce4d - https://git.kernel.org/stable/c/446045cf682af12d9294765f6c46084b374b5654 - https://gi
40687f42bfa40e091bb4a55d7960ce4d - https://git.kernel.org/stable/c/446045cf682af12d9294765f6c46084b374b5654 - https://git.kernel.org/stable/c/09d16cee6285d37cc76311c29add6d97a7e4acda - https://git.kernel.org/stable/c/05ec8192ee4bfdf2a8894a68350dac9f1a155fa6 - https://git.kernel.org/stable/c/1f50392650ae794a1aea41c213c6a3e1c824413c - https://git.kernel.org/stable/c/20fd40fc6f2c2b41dc6f637f88d494b14e9c21f1 - https://git.kernel.org/stable/c/1ea500ce6f7c9106e4a561d28e69215f3d451818 - https://git.kernel.org/stable/c/8609f5cfdc872fc3a462efa6a3eca5cb1e2f6446
CVE ID: CVE-2021-47057 State: PUBLISHED Published: 2024-02-29T22:37:32.216Z Last Updated: 2025-05-04T07:03:19.320Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map In the case where the dma_iv mapping fails, the return error path leaks the memory allocated to object d. Fix this by adding a new error return label and jumping to this to ensure d is free'd before the return. Addresses-Coverity: ("Resource leak") Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/617ec35ed51f731a593ae7274228ef
ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/617ec35ed51f731a593ae7274228ef2cfc9cb781 - https://git.kernel.org/stable/c/e1f2d739849c3239df1ea3f97d40bade4b808410 - https://git.kernel.org/stable/c/6516cb852d704ff8d615de1f93cd443a99736c3d - https://git.kernel.org/stable/c/98b5ef3e97b16eaeeedb936f8bda3594ff84a70e
CVE ID: CVE-2021-47058 State: PUBLISHED Published: 2024-02-29T22:37:33.232Z Last Updated: 2025-05-04T07:03:20.494Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: regmap: set debugfs_name to NULL after it is freed There is a upstream commit cffa4b2122f5("regmap:debugfs: Fix a memory leak when calling regmap_attach_dev") that adds a if condition when create name for debugfs_name. With below function invoking logical, debugfs_name is freed in regmap_debugfs_exit(), but it is not created again because of the if condition introduced by above commit. regmap_reinit_cache() regmap_debugfs_exit() ... regmap_debugfs_init() So, set debugf
ndition introduced by above commit. regmap_reinit_cache() regmap_debugfs_exit() ... regmap_debugfs_init() So, set debugfs_name to NULL after it is freed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2dc1554d5f0fdaf47cc5bea442b84b9226fea867 - https://git.kernel.org/stable/c/d8897f7b2283a500666c85ef06e820df38ed7b52 - https://git.kernel.org/stable/c/eb949f891226c012138ffd9df90d1e509f428ae6 - https://git.kernel.org/stable/c/c764e375ae647832de1ee73d43a4bb3ef8a8f43d - https://git.kernel.org/stable/c/b9e569ae1da3a113b3acee8703c94777fd20938a - https://git.kernel.org/stable/c/e41a962f82e7afb5b1ee644f48ad0b3aee656268
CVE ID: CVE-2021-47059 State: PUBLISHED Published: 2024-02-29T22:37:34.052Z Last Updated: 2025-05-04T07:03:21.675Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - fix result memory leak on error path This patch fixes a memory leak on an error path. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1f12aaf07f61122cf5074d29714ee26f8d44b0e7 - https://git.kernel.org/stable/c/ca065a93699f8cf3f42c60eefed73086007e928e - https://git.kernel.org/stable/c/50e7b39b808430ad49a637dc6fb72ca93b451b13 - https://git.kernel.org/stable/c/1dbc6a1e25be8575d6c41
git.kernel.org/stable/c/50e7b39b808430ad49a637dc6fb72ca93b451b13 - https://git.kernel.org/stable/c/1dbc6a1e25be8575d6c4114d1d2b841a796507f7
CVE ID: CVE-2021-47060 State: PUBLISHED Published: 2024-02-29T22:37:34.885Z Last Updated: 2025-05-04T12:41:00.115Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: Stop looking for coalesced MMIO zones if the bus is destroyed Abort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev() fails to allocate memory for the new instance of the bus. If it can't instantiate a new bus, unregister_dev() destroys all devices _except_ the target device. But, it doesn't tell the caller that it obliterated the bus and invoked the destructor for all devices that were on the bus. In the coalesced MMIO case, this can result in a del
us and invoked the destructor for all devices that were on the bus. In the coalesced MMIO case, this can result in a deleted list entry dereference due to attempting to continue iterating on coalesced_zones after future entries (in the walk) have been deleted. Opportunistically add curly braces to the for-loop, which encompasses many lines but sneaks by without braces due to the guts being a single if statement. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7d1bc32d6477ff96a32695ea4be8144e4513ab2d - https://git.kernel.org/stable/c/2a20592baff59c5351c5200ec667e1a2aa22af85 - https://git.kernel.org/stable/c/168e82f640ed
https://git.kernel.org/stable/c/2a20592baff59c5351c5200ec667e1a2aa22af85 - https://git.kernel.org/stable/c/168e82f640ed1891a700bdb43e37da354b2ab63c - https://git.kernel.org/stable/c/50cbad42bfea8c052b7ca590bd4126cdc898713c - https://git.kernel.org/stable/c/5d3c4c79384af06e3c8e25b7770b6247496b4417
CVE ID: CVE-2021-47061 State: PUBLISHED Published: 2024-02-29T22:37:35.689Z Last Updated: 2025-05-04T12:41:01.255Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU If allocating a new instance of an I/O bus fails when unregistering a device, wait to destroy the device until after all readers are guaranteed to see the new null bus. Destroying devices before the bus is nullified could lead to use-after-free since readers expect the devices on their reference of the bus to remain valid. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
their reference of the bus to remain valid. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343 - https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927 - https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d - https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250
CVE ID: CVE-2021-47062 State: PUBLISHED Published: 2024-02-29T22:37:36.468Z Last Updated: 2025-05-04T07:03:25.492Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs Use the kvm_for_each_vcpu() helper to iterate over vCPUs when encrypting VMSAs for SEV, which effectively switches to use online_vcpus instead of created_vcpus. This fixes a possible null-pointer dereference as created_vcpus does not guarantee a vCPU exists, since it is updated at the very beginning of KVM_CREATE_VCPU. created_vcpus exists to allow the bulk of vCPU creation to run in parallel, while s
e very beginning of KVM_CREATE_VCPU. created_vcpus exists to allow the bulk of vCPU creation to run in parallel, while still correctly restricting the max number of max vCPUs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bd0cced2ae93195668f983d443f7f17e8efd24d2 - https://git.kernel.org/stable/c/ba7bf5d6336aa9c0d977b161bfa420c56d46ee40 - https://git.kernel.org/stable/c/c36b16d29f3af5f32fc1b2a3401bf48f71cabee1
CVE ID: CVE-2021-47063 State: PUBLISHED Published: 2024-02-29T22:37:37.429Z Last Updated: 2025-05-04T07:03:26.567Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: bridge/panel: Cleanup connector on bridge detach If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects in the call to drm_mode_config_cleanup(). However, since our drm_connector is devm-allocated, by the time drm_mode_config_cleanup() will be called, our connector will be long gone. Therefore, the connector must be cleaned up when the bridge is detached to avoid use-after-free condit
ill be long gone. Therefore, the connector must be cleaned up when the bridge is detached to avoid use-after-free conditions. v2: Cleanup connector only if it was created v3: Add FIXME v4: (Use connector->dev) directly in if() block Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ce450934a00cf896e648fde08d0bd1426653d7a2 - https://git.kernel.org/stable/c/18149b420c9bd93c443e8d1f48a063d71d9f6aa1 - https://git.kernel.org/stable/c/98d7d76a74e48ec3ddf2e23950adff7edcab9327 - https://git.kernel.org/stable/c/4d906839d321c2efbf3fed4bc31ffd9ff55b75c0
CVE ID: CVE-2021-47064 State: PUBLISHED Published: 2024-02-29T22:37:38.257Z Last Updated: 2025-05-04T07:03:27.593Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mt76: fix potential DMA mapping leak With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap could potentially inherit a non-zero value from stack garbage. If this happens, it will cause DMA mappings for MCU command frames to not be unmapped after completion Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9fa26701cd1fc4d932d431971efc5746325bdfce - https://git.kernel.org/stable/c
References: - https://git.kernel.org/stable/c/9fa26701cd1fc4d932d431971efc5746325bdfce - https://git.kernel.org/stable/c/9b68ce2856dadc0e1cb6fd21fbeb850da49efd08 - https://git.kernel.org/stable/c/91b9548d413fda488ea853cd1b9f59b572db3a0c - https://git.kernel.org/stable/c/b4403cee6400c5f679e9c4a82b91d61aa961eccf
CVE ID: CVE-2021-47065 State: PUBLISHED Published: 2024-02-29T22:37:39.135Z Last Updated: 2025-05-04T07:03:28.649Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtw88: Fix array overrun in rtw_get_tx_power_params() Using a kernel with the Undefined Behaviour Sanity Checker (UBSAN) enabled, the following array overrun is logged: ================================================================================ UBSAN: array-index-out-of-bounds in /home/finger/wireless-drivers-next/drivers/net/wireless/realtek/rtw88/phy.c:1789:34 index 5 is out of range for type 'u8 [5]' CPU: 2 PID: 84 Comm: kworker/u16:3 Tainted: G O 5.12.0-rc5-00
88/phy.c:1789:34 index 5 is out of range for type 'u8 [5]' CPU: 2 PID: 84 Comm: kworker/u16:3 Tainted: G O 5.12.0-rc5-00086-gd88bba47038e-dirty #651 Hardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.50 09/29/2014 Workqueue: phy0 ieee80211_scan_work [mac80211] Call Trace: dump_stack+0x64/0x7c ubsan_epilogue+0x5/0x40 __ubsan_handle_out_of_bounds.cold+0x43/0x48 rtw_get_tx_power_params+0x83a/drivers/net/wireless/realtek/rtw88/0xad0 [rtw_core] ? rtw_pci_read16+0x20/0x20 [rtw_pci] ? check_hw_ready+0x50/0x90 [rtw_core] rtw_phy_get_tx_power_index+0x4d/0xd0 [rtw_core] rtw_phy_set_tx_power_level+0xee/0x1b0 [rtw_core] rtw_set_channel+0xab/0x110 [rtw_core] rtw_ops_config+0x87/0xc0 [rtw_core
tw_phy_set_tx_power_level+0xee/0x1b0 [rtw_core] rtw_set_channel+0xab/0x110 [rtw_core] rtw_ops_config+0x87/0xc0 [rtw_core] ieee80211_hw_config+0x9d/0x130 [mac80211] ieee80211_scan_state_set_channel+0x81/0x170 [mac80211] ieee80211_scan_work+0x19f/0x2a0 [mac80211] process_one_work+0x1dd/0x3a0 worker_thread+0x49/0x330 ? rescuer_thread+0x3a0/0x3a0 kthread+0x134/0x150 ? kthread_create_worker_on_cpu+0x70/0x70 ret_from_fork+0x22/0x30 ================================================================================ The statement where an array is being overrun is shown in the following snippet: if (rate <= DESC_RATE11M) tx_power = pwr_idx_2g->cck_base[group]; else ====> tx_power = pwr_idx_2g->bw40_bas
ng snippet: if (rate <= DESC_RATE11M) tx_power = pwr_idx_2g->cck_base[group]; else ====> tx_power = pwr_idx_2g->bw40_base[group]; The associated arrays are defined in main.h as follows: struct rtw_2g_txpwr_idx { u8 cck_base[6]; u8 bw40_base[5]; struct rtw_2g_1s_pwr_idx_diff ht_1s_diff; struct rtw_2g_ns_pwr_idx_diff ht_2s_diff; struct rtw_2g_ns_pwr_idx_diff ht_3s_diff; struct rtw_2g_ns_pwr_idx_diff ht_4s_diff; }; The problem arises because the value of group is 5 for channel 14. The trivial increase in the dimension of bw40_base fails as this struct must match the layout of efuse. The fix is to add the rate as an argument to rtw_get_channel_group() and set the group for channel 14 to 4 if rat
efuse. The fix is to add the rate as an argument to rtw_get_channel_group() and set the group for channel 14 to 4 if rate <= DESC_RATE11M. This patch fixes commit fa6dfe6bff24 ("rtw88: resolve order of tx power setting routines") Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6b5aa0cf321c25f41e09a61c83ee4dc7ab9549cb - https://git.kernel.org/stable/c/95fb153c6027924cda3422120169d1890737f3a0 - https://git.kernel.org/stable/c/5f3dbced8eaa5c9ed7d6943f3fea99f235a6516a - https://git.kernel.org/stable/c/9cd09722e18a08b6a3d68b8bccfac39ddc22434c - https://git.kernel.org/stable/c/2ff25985ea9ccc6c9af2c77b0b49045adcc62e0e
CVE ID: CVE-2021-47066 State: PUBLISHED Published: 2024-02-29T22:37:39.917Z Last Updated: 2025-05-04T07:03:29.701Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: async_xor: increase src_offs when dropping destination page Now we support sharing one page if PAGE_SIZE is not equal stripe size. To support this, it needs to support calculating xor value with different offsets for each r5dev. One offset array is used to record those offsets. In RMW mode, parity page is used as a source page. It sets ASYNC_TX_XOR_DROP_DST before calculating xor value in ops_run_prexor5. So it needs to add src_list and src_offs at the same time. Now i
OP_DST before calculating xor value in ops_run_prexor5. So it needs to add src_list and src_offs at the same time. Now it only needs src_list. So the xor value which is calculated is wrong. It can cause data corruption problem. I can reproduce this problem 100% on a POWER8 machine. The steps are: mdadm -CR /dev/md0 -l5 -n3 /dev/sdb1 /dev/sdc1 /dev/sdd1 --size=3G mkfs.xfs /dev/md0 mount /dev/md0 /mnt/test mount: /mnt/test: mount(2) system call failed: Structure needs cleaning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cab2e8e5997b592fdb7d02cf2387b4b8e3057174 - https://git.kernel.org/stable/c/29ffa50f33de824b5491f8
it.kernel.org/stable/c/cab2e8e5997b592fdb7d02cf2387b4b8e3057174 - https://git.kernel.org/stable/c/29ffa50f33de824b5491f8239c88c4a0efdd03af - https://git.kernel.org/stable/c/53f8208e11abd6dde9480dfcb97fecdb1bc2ac18 - https://git.kernel.org/stable/c/ceaf2966ab082bbc4d26516f97b3ca8a676e2af8
CVE ID: CVE-2021-47067 State: PUBLISHED Published: 2024-02-29T22:37:40.816Z Last Updated: 2025-05-04T07:03:30.937Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc/tegra: regulators: Fix locking up when voltage-spread is out of range Fix voltage coupler lockup which happens when voltage-spread is out of range due to a bug in the code. The max-spread requirement shall be accounted when CPU regulator doesn't have consumers. This problem is observed on Tegra30 Ouya game console once system-wide DVFS is enabled in a device-tree. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.
in a device-tree. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a1ad124c836816fac8bd5e461d36eaf33cee4e24 - https://git.kernel.org/stable/c/dc4452867200fa94589b382740952b58aa1c3e6c - https://git.kernel.org/stable/c/ff39adf5d31c72025bba799aec69c5c86d81d549 - https://git.kernel.org/stable/c/ef85bb582c41524e9e68dfdbde48e519dac4ab3d
CVE ID: CVE-2021-47068 State: PUBLISHED Published: 2024-02-29T22:37:41.736Z Last Updated: 2025-05-04T07:03:32.020Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/nfc: fix use-after-free llcp_sock_bind/connect Commits 8a4cd82d ("nfc: fix refcount leak in llcp_sock_connect()") and c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()") fixed a refcount leak bug in bind/connect but introduced a use-after-free if the same local is assigned to 2 different sockets. This can be triggered by the following simple program: int sock1 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP ); int sock2 = socket( AF_NFC, SOCK_STREAM, NFC_SOC
program: int sock1 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP ); int sock2 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP ); memset( &addr, 0, sizeof(struct sockaddr_nfc_llcp) ); addr.sa_family = AF_NFC; addr.nfc_protocol = NFC_PROTO_NFC_DEP; bind( sock1, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) ) bind( sock2, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) ) close(sock1); close(sock2); Fix this by assigning NULL to llcp_sock->local after calling nfc_llcp_local_put. This addresses CVE-2021-23134. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/26157c82ba756767b2bd66d28a71b1bc45444
lnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/26157c82ba756767b2bd66d28a71b1bc454447f6 - https://git.kernel.org/stable/c/ccddad6dd28530e716448e594c9ca7c76ccd0570 - https://git.kernel.org/stable/c/18ae4a192a4496e48a5490b52812645d2413307c - https://git.kernel.org/stable/c/48fba458fe54cc2a980a05c13e6c19b8b2cfb610 - https://git.kernel.org/stable/c/e32352070bcac22be6ed8ab635debc280bb65b8c - https://git.kernel.org/stable/c/6b7021ed36dabf29e56842e3408781cd3b82ef6e - https://git.kernel.org/stable/c/374cdde4dcc9c909a60713abdbbf96d5e3e09f91 - https://git.kernel.org/stable/c/18175fe17ae043a0b81e5d511f8817825784c299 - https://git.kernel.org/stable/c/c61760e6940dd4039
s://git.kernel.org/stable/c/18175fe17ae043a0b81e5d511f8817825784c299 - https://git.kernel.org/stable/c/c61760e6940dd4039a7f5e84a6afc9cdbf4d82b6