huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-47101: kernel: asix: fix uninit-value in asix_mdio_read()
Component: kernel
Severity: Low
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-03-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

asix: fix uninit-value in asix_mdio_read()

asix_read_cmd() may read less than sizeof(smsr) bytes and in this case
smsr will be uninitialized.

Fail log:
BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]
BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497
BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497
 asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]
 asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497
 asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497


Affected upstream versions: 4.9
Fixed upstream versions: 0, 5.15.12, 5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d259f621c85949f30cc578cac813b82bb5169f56
CVE-2021-47103: kernel: inet: fully convert sk->sk_rx_dst to RCU rules
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-03-04T00:00:00+00:00

A use-after-free vulnerability was found in the TCP IP protocol in the Linux Kernel, where a delete operation of the RCU-protected pointer is supposed to clear the pointer before the call_rcu()/synchronize_rcu() guarding the actual memory freeing. This flaw allows a local attacker to crash the system or leak kernel internal information.


Affected upstream versions: 3.6
Fixed upstream versions: 0, 4.14.296, 4.19.262, 4.9.331, 5.10.150, 5.15.12, 5.16, 5.4.220
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 68c34ce11ef23328692aa35fa6aaafdd75913100
CVE-2021-47107: kernel: NFSD: Fix READDIR buffer overflow
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-03-04T00:00:00+00:00

CVE-2021-47107 is a flaw in the Linux system that runs file-sharing services (NFS). The problem happened because the system did not properly check how much data it should handle when someone asked to list the contents of a folder. If that request was made with a very small value, the system could become confused and try to use more memory than it should. This mistake could cause the computer to crash, stop responding, or even give an attacker a chance to run harmful code. The issue has since been fixed in newer versions of Linux by adding proper checks to prevent unsafe requests.

Statement: Red Hat Product Security has rated this bug as moderate as the out of box configuration of NFS protects the process from arbitrary code execution scenarios. There is a risk to availablity on successful exploitation of this bug.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.12, 5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9e291a6a28d32545ed2fd959a8165144d1724df1
CVE-2021-47138: kernel: cxgb4: avoid accessing registers when clearing filters
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-03-25T00:00:00+00:00

A vulnerability was found in the Linux kernel whereby hardware registries that have the server TID base may contain invalid values when the adapter is in a bad state. Reading these invalid values can result in out-of-bounds memory access, which can cause memory corruption or crashes.

Statement: Red Hat believes this vulnerability to be of Moderate impact because the privileges required for exploitation are high. More specifically, privileged code is required to intentionally place the adapter into a bad state and then trigger the cxgb4 filter cleanup routines.

Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.42, 5.12.9, 5.13, 5.4.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0bf49b3c8d8b3a43ce09f1b2db70e5484d31fcdf
CVE-2021-47153: kernel: i2c: i801: Don&#39;t generate an interrupt on bus reset
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-03-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

i2c: i801: Don't generate an interrupt on bus reset

Now that the i2c-i801 driver supports interrupts, setting the KILL bit
in a attempt to recover from a timed out transaction triggers an
interrupt. Unfortunately, the interrupt handler (i801_isr) is not
prepared for this situation and will try to process the interrupt as
if it was signaling the end of a successful transaction. In the case
of a block transaction, this can result in an out-of-range memory
access.

This condition was reproduced several times by syzbot:
https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e
https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e
https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e
https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb
https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a
https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79

So disable interrupts while trying to reset the bus. Interrupts will
be enabled again for the following transaction.


Affected upstream versions: 3.6
Fixed upstream versions: 0, 4.14.235, 4.19.193, 4.4.271, 4.9.271, 5.10.42, 5.12.9, 5.13, 5.4.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f9469082126cebb7337db3992d143f5e4edfe629
CVE-2021-47171: kernel: net: usb: fix memory leak in smsc75xx_bind
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-03-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: usb: fix memory leak in smsc75xx_bind

Syzbot reported memory leak in smsc75xx_bind().
The problem was is non-freed memory in case of
errors after memory allocation.

backtrace:
  [<ffffffff84245b62>] kmalloc include/linux/slab.h:556 [inline]
  [<ffffffff84245b62>] kzalloc include/linux/slab.h:686 [inline]
  [<ffffffff84245b62>] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460
  [<ffffffff82b5b2e6>] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728


Affected upstream versions: 2.6.34
Fixed upstream versions: 0, 4.14.235, 4.19.193, 4.4.271, 4.9.271, 5.10.42, 5.12.9, 5.13, 5.4.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 200dbfcad8011e50c3cec269ed7b980836eeb1fa
CVE-2021-47185: kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
Component: kernel
Severity: Low
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc

When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup,
which look like this one:

  Workqueue: events_unbound flush_to_ldisc
  Call trace:
   dump_backtrace+0x0/0x1ec
   show_stack+0x24/0x30
   dump_stack+0xd0/0x128
   panic+0x15c/0x374
   watchdog_timer_fn+0x2b8/0x304
   __run_hrtimer+0x88/0x2c0
   __hrtimer_run_queues+0xa4/0x120
   hrtimer_interrupt+0xfc/0x270
   arch_timer_handler_phys+0x40/0x50
   handle_percpu_devid_irq+0x94/0x220
   __handle_domain_irq+0x88/0xf0
   gic_handle_irq+0x84/0xfc
   el1_irq+0xc8/0x180
   slip_unesc+0x80/0x214 [slip]
   tty_ldisc_receive_buf+0x64/0x80
   tty_port_default_receive_buf+0x50/0x90
   flush_to_ldisc+0xbc/0x110
   process_one_work+0x1d4/0x4b0
   worker_thread+0x180/0x430
   kthread+0x11c/0x120

In the testcase pty04, The first process call the write syscall to send
data to the pty master. At the same time, the workqueue will do the
flush_to_ldisc to pop data in a loop until there is no more data left.
When the sender and workqueue running in different core, the sender sends
data fastly in full time which will result in workqueue doing work in loop
for a long time and occuring softlockup in flush_to_ldisc with kernel
configured without preempt. So I add need_resched check and cond_resched
in the flush_to_ldisc loop to avoid it.


Affected upstream versions: 3.0
Fixed upstream versions: 0, 4.14.256, 4.19.218, 4.4.293, 4.9.291, 5.10.82, 5.15.5, 5.16, 5.4.162
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0380f643f3a7a61b0845cdc738959c2ad5735d61
CVE-2021-47203: kernel: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-10T00:00:00+00:00

A vulnerability was found in the Linux kernel while parsing the txq list in the lpfc_drain_txq() function. Due to improper handling of a local fail message string which is set when a job fails and is never unset for subsequent jobs, this issue can lead to list corruption as jobs may be added to both the txq and the completions list. This could result in system instability or inconsistencies.

Statement: This issue is fixed in RHEL-8.6 and above (including 8.10):
~~~
in (rhel-8.6, rhel-8.7, rhel-8.8, rhel-8.9, rhel-8.10) scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

~~~

Affected upstream versions: 2.6.36
Fixed upstream versions: 0, 4.14.256, 4.19.218, 4.4.293, 4.9.291, 5.10.82, 5.15.5, 5.16, 5.4.162
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad4776b5eb2e58af1226847fcd3b4f6d051674dd
CVE-2021-47221: kernel: mm/slub: actually fix freelist pointer vs redzoning
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: actually fix freelist pointer vs redzoning

It turns out that SLUB redzoning ("slub_debug=Z") checks from
s->object_size rather than from s->inuse (which is normally bumped to
make room for the freelist pointer), so a cache created with an object
size less than 24 would have the freelist pointer written beyond
s->object_size, causing the redzone to be corrupted by the freelist
pointer.  This was very visible with "slub_debug=ZF":

  BUG test (Tainted: G    B            ): Right Redzone overwritten
  -----------------------------------------------------------------------------

  INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb
  INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200
  INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620

  Redzone  (____ptrval____): bb bb bb bb bb bb bb bb               ........
  Object   (____ptrval____): 00 00 00 00 00 f6 f4 a5               ........
  Redzone  (____ptrval____): 40 1d e8 1a aa                        @....
  Padding  (____ptrval____): 00 00 00 00 00 00 00 00               ........

Adjust the offset to stay within s->object_size.

(Note that no caches of in this size range are known to exist in the
kernel currently.)


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.46, 5.12.13, 5.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f6ed2357541612a13a5841b3af4dc32ed984a25f
CVE-2021-47236: kernel: net: cdc_eem: fix tx fixup skb leak
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: cdc_eem: fix tx fixup skb leak

when usbnet transmit a skb, eem fixup it in eem_tx_fixup(),
if skb_copy_expand() failed, it return NULL,
usbnet_start_xmit() will have no chance to free original skb.

fix it by free orginal skb in eem_tx_fixup() first,
then check skb clone status, if failed, return NULL to usbnet.


Affected upstream versions: 2.6.30
Fixed upstream versions: 0, 4.14.238, 4.19.196, 4.4.274, 4.9.274, 5.10.46, 5.12.13, 5.13, 5.4.128
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f12554b0ff639e74612cc01b3b4a049e098d2d65
CVE-2021-47257: kernel: net: ieee802154: fix null deref in parse dev addr
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ieee802154: fix null deref in parse dev addr

Fix a logic error that could result in a null deref if the user sets
the mode incorrectly for the given addr type.


Affected upstream versions: 4.4
Fixed upstream versions: 0, 4.14.238, 4.19.196, 4.9.274, 5.10.45, 5.12.12, 5.13, 5.4.127
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1f95741981c899c4724647291fec5faa3c777185
CVE-2021-47287: kernel: driver core: auxiliary bus: Fix memory leak when driver_register() fail
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

driver core: auxiliary bus: Fix memory leak when driver_register() fail

If driver_register() returns with error we need to free the memory
allocated for auxdrv->driver.name before returning from
__auxiliary_driver_register()


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.13.6, 5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ce5b3de58fc21303722df46551f7eb9a91afb409
CVE-2021-47289: kernel: ACPI: fix NULL pointer dereference
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

A vulnerability was found in the Linux kernel’s ACPI subsystem, where the acpi_dev_put() function could attempt to operate on a NULL pointer, leads to a system crash due to a NULL pointer dereference, causing instability when managing ACPI devices.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.57, 5.13.6, 5.14, 5.4.139
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 38f54217b423c0101d03a00feec6fb8ec608b12e
CVE-2021-47293: kernel: net/sched: act_skbmod: Skip non-Ethernet packets
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L)
Public date: 2024-05-21T00:00:00+00:00

A vulnerability was found in the Linux kernel’s act_skbmod module, where the tcf_skbmod_act() function mistakenly assumes all packets use Ethernet as their protocol. This issue can lead to the corruption of non-Ethernet packets, such as those from CAN devices, if skbmod actions are incorrectly applied. This misinterpretation results in unexpected packet manipulation and data corruption.

Statement: A flaw in the act_skbmod traffic control action caused it to modify non-Ethernet packets without validating the link-layer type, silently corrupting frames on devices such as CAN. The patch adds a guard to skip skbmod actions unless skb->dev->type == ARPHRD_ETHER. This results in a moderate (or low) severity local integrity issue requiring administrative privileges within a (network) namespace to trigger.

This vulnerability is classified as moderate severity due to its potential impact on packet integrity.

Please note that this fix was incorporated in Red Hat Enterprise Linux 8.10 at the time of its release.

Affected upstream versions: 4.9
Fixed upstream versions: 0, 4.19.199, 5.10.54, 5.13.6, 5.14, 5.4.136
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e4fdca366806f6bab374d1a95e626a10a3854b0c
CVE-2021-47301: kernel: igb: Fix use-after-free error during reset
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

A vulnerability was found in the Linux kernel's igb driver. During a reset operation, the driver could access memory that had already been freed. If the driver attempts to use this freed memory, it can lead to a system crash or instability because the memory may no longer be valid.

Statement: This vulnerability is rated as a Moderate severity because the issue primarily impacts system stability by potentially causing a crash if the driver interacts with freed memory. It does not expose sensitive information or allow unauthorized access.

Affected upstream versions: 4.12
Fixed upstream versions: 0, 4.14.241, 4.19.199, 5.10.54, 5.13.6, 5.14, 5.4.136
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d7367f781e5a9ca5df9082b15b272b55e76931f8
CVE-2021-47304: kernel: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized

This commit fixes a bug (found by syzkaller) that could cause spurious
double-initializations for congestion control modules, which could cause
memory leaks or other problems for congestion control modules (like CDG)
that allocate memory in their init functions.

The buggy scenario constructed by syzkaller was something like:

(1) create a TCP socket
(2) initiate a TFO connect via sendto()
(3) while socket is in TCP_SYN_SENT, call setsockopt(TCP_CONGESTION),
    which calls:
       tcp_set_congestion_control() ->
         tcp_reinit_congestion_control() ->
           tcp_init_congestion_control()
(4) receive ACK, connection is established, call tcp_init_transfer(),
    set icsk_ca_initialized=0 (without first calling cc->release()),
    call tcp_init_congestion_control() again.

Note that in this sequence tcp_init_congestion_control() is called
twice without a cc->release() call in between. Thus, for CC modules
that allocate memory in their init() function, e.g, CDG, a memory leak
may occur. The syzkaller tool managed to find a reproducer that
triggered such a leak in CDG.

The bug was introduced when that commit 8919a9b31eb4 ("tcp: Only init
congestion control if not initialized already")
introduced icsk_ca_initialized and set icsk_ca_initialized to 0 in
tcp_init_transfer(), missing the possibility for a sequence like the
one above, where a process could call setsockopt(TCP_CONGESTION) in
state TCP_SYN_SENT (i.e. after the connect() or TFO open sendmsg()),
which would call tcp_init_congestion_control(). It did not intend to
reset any initialization that the user had already explicitly made;
it just missed the possibility of that particular sequence (which
syzkaller managed to find).


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.53, 5.13.5, 5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad4ba3404931745a5977ad12db4f0c34080e52f7
CVE-2021-47310: kernel: net: ti: fix UAF in tlan_remove_one
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

A vulnerability was found in the Linux kernel's TI TLAN driver, where the tlan_remove_one function can lead to a use-after-free issue when the driver attempts to access private data after the network device has already been freed, potentially causing system instability or crash.

Statement: This vulnerability is rated as a moderate because the use-after-free can disrupt network functionality, resulting in service interruptions, but it does not directly compromise sensitive information.

Affected upstream versions: 3.10
Fixed upstream versions: 0, 4.14.241, 4.19.199, 4.4.277, 4.9.277, 5.10.53, 5.13.5, 5.14, 5.4.135
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a18a8d9cfbb112ad72e625372849adc3986fd6bf
CVE-2021-47311: kernel: net: qcom/emac: fix UAF in emac_remove
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

A vulnerability was found in the Linux kernel's Qualcomm EMAC driver, where the emac_remove function can lead to a use-after-free issue when the driver tries to access data after the network device has been freed, causing instability and a crash in the network subsystem.

Statement: This vulnerability is rated as a moderate severity because the use-after-free can disrupt the network operations, leading to potential service interruptions, but it does not directly expose sensitive data; it may result in system instability.

Affected upstream versions: 4.9
Fixed upstream versions: 0, 4.14.241, 4.19.199, 4.9.277, 5.10.53, 5.13.5, 5.14, 5.4.135
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4d04a42b926e682140776e54188f4a44f1f01a81
CVE-2021-47321: kernel: watchdog: Fix possible use-after-free by calling del_timer_sync()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

A vulnerability was found  in the del_timer() function in the Linux kernel's watchdog driver. This issue occurs because the function does not wait for the timer handler to finish, which may lead to a situation where the handler runs after the driver that has been removed, causing a use-after-free issue.

Statement: This vulnerability is rated as a moderate severity because this issue does not allow unauthorized access or data leakage, but it poses a risk of system instability and crashes. The potential for a use-after-free condition can disrupt normal operations.

Affected upstream versions: 4.3
Fixed upstream versions: 0, 4.14.240, 4.19.198, 4.4.276, 4.9.276, 5.10.52, 5.12.19, 5.13.4, 5.14, 5.4.134
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 58606882ad8ec6c39e0f40344b922921ef94ab4d