CVE-2021-46979 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix ioctl handlers removal Currently ioctl handlers are removed twice. For the first time during iio_device_unregister() then later on inside iio_device_unregister_eventset() and iio_buffers_free_sysfs_and_mask(). Double free leads to kernel panic. Fix this by not touching ioctl handlers list directly but rather letting code responsible for registration call the matching cleanup routine itself.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/11e1cae5da4096552f7c091476cbadbc0d1817da
https://git.kernel.org/stable/c/901f84de0e16bde10a72d7eb2f2eb73fcde8fa1a
https://git.kernel.org/stable/c/ab6c935ba3a04317632f3b8b68675bdbaf395303
https://lore.kernel.org/linux-cve-announce/2024022823-CVE-2021-46979-de90@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-46979
https://www.cve.org/CVERecord?id=CVE-2021-46979

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-02-28T08:13:09.736Z

Updated: 2024-11-04T11:57:02.628Z

Reserved: 2024-02-27T18:42:55.945Z

Link: CVE-2021-46979

Vulnrichment

Updated: 2024-08-04T05:24:38.457Z

NVD

Status : Awaiting Analysis

Published: 2024-02-28T09:15:37.230

Modified: 2024-02-28T14:06:45.783

Link: CVE-2021-46979

Redhat

Severity : Low

Publid Date: 2024-02-28T00:00:00Z

Links: CVE-2021-46979 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-46979", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-27T18:42:55.945Z", "datePublished": "2024-02-28T08:13:09.736Z", "dateUpdated": "2024-11-04T11:57:02.628Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:57:02.628Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: core: fix ioctl handlers removal\n\nCurrently ioctl handlers are removed twice. For the first time during\niio_device_unregister() then later on inside\niio_device_unregister_eventset() and iio_buffers_free_sysfs_and_mask().\nDouble free leads to kernel panic.\n\nFix this by not touching ioctl handlers list directly but rather\nletting code responsible for registration call the matching cleanup\nroutine itself."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/industrialio-core.c"], "versions": [{"version": "8dedcc3eee3a", "lessThan": "11e1cae5da40", "status": "affected", "versionType": "git"}, {"version": "8dedcc3eee3a", "lessThan": "ab6c935ba3a0", "status": "affected", "versionType": "git"}, {"version": "8dedcc3eee3a", "lessThan": "901f84de0e16", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/industrialio-core.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.11.22", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.5", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/11e1cae5da4096552f7c091476cbadbc0d1817da"}, {"url": "https://git.kernel.org/stable/c/ab6c935ba3a04317632f3b8b68675bdbaf395303"}, {"url": "https://git.kernel.org/stable/c/901f84de0e16bde10a72d7eb2f2eb73fcde8fa1a"}], "title": "iio: core: fix ioctl handlers removal", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-05T16:50:41.718465Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:13:09.338Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:38.457Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/11e1cae5da4096552f7c091476cbadbc0d1817da", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ab6c935ba3a04317632f3b8b68675bdbaf395303", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/901f84de0e16bde10a72d7eb2f2eb73fcde8fa1a", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/11e1cae5da4096552f7c091476cbadbc0d1817da", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ab6c935ba3a04317632f3b8b68675bdbaf395303", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/901f84de0e16bde10a72d7eb2f2eb73fcde8fa1a", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:38.457Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-05T16:50:41.718465Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:15.426Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "iio: core: fix ioctl handlers removal", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8dedcc3eee3a", "lessThan": "11e1cae5da40", "versionType": "git"}, {"status": "affected", "version": "8dedcc3eee3a", "lessThan": "ab6c935ba3a0", "versionType": "git"}, {"status": "affected", "version": "8dedcc3eee3a", "lessThan": "901f84de0e16", "versionType": "git"}], "programFiles": ["drivers/iio/industrialio-core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.11.22", "versionType": "semver", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12.5", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iio/industrialio-core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/11e1cae5da4096552f7c091476cbadbc0d1817da"}, {"url": "https://git.kernel.org/stable/c/ab6c935ba3a04317632f3b8b68675bdbaf395303"}, {"url": "https://git.kernel.org/stable/c/901f84de0e16bde10a72d7eb2f2eb73fcde8fa1a"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: core: fix ioctl handlers removal\n\nCurrently ioctl handlers are removed twice. For the first time during\niio_device_unregister() then later on inside\niio_device_unregister_eventset() and iio_buffers_free_sysfs_and_mask().\nDouble free leads to kernel panic.\n\nFix this by not touching ioctl handlers list directly but rather\nletting code responsible for registration call the matching cleanup\nroutine itself."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:57:02.628Z"}}}, "cveMetadata": {"cveId": "CVE-2021-46979", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:57:02.628Z", "dateReserved": "2024-02-27T18:42:55.945Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-28T08:13:09.736Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}