CVE-2021-46991 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix use-after-free in i40e_client_subtask() Currently the call to i40e_client_del_instance frees the object pf->cinst, however pf->cinst->lan_info is being accessed after the free. Fix this by adding the missing return. Addresses-Coverity: ("Read from pointer after free")

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/1fd5d262e7442192ac7611ff1597a36c5b044323
https://git.kernel.org/stable/c/38318f23a7ef86a8b1862e5e8078c4de121960c3
https://git.kernel.org/stable/c/4ebc10aa7cd17fd9857dedac69600465c9dd16d1
https://git.kernel.org/stable/c/829a713450b8fb127cbabfc1244c1d8179ec5107
https://git.kernel.org/stable/c/c1322eaeb8af0d8985b5cc5fa759140fa0e57b84
https://git.kernel.org/stable/c/d718c15a2bf9ae082d5ae4d177fb19ef23cb4132
https://lore.kernel.org/linux-cve-announce/2024022826-CVE-2021-46991-3c16@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-46991
https://www.cve.org/CVERecord?id=CVE-2021-46991

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-02-28T08:13:17.195Z

Updated: 2024-11-04T11:57:16.771Z

Reserved: 2024-02-27T18:42:55.949Z

Link: CVE-2021-46991

Vulnrichment

Updated: 2024-08-04T05:24:38.447Z

NVD

Status : Awaiting Analysis

Published: 2024-02-28T09:15:37.787

Modified: 2024-02-28T14:06:45.783

Link: CVE-2021-46991

Redhat

Severity : Moderate

Publid Date: 2024-02-28T00:00:00Z

Links: CVE-2021-46991 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-46991", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-27T18:42:55.949Z", "datePublished": "2024-02-28T08:13:17.195Z", "dateUpdated": "2024-11-04T11:57:16.771Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:57:16.771Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix use-after-free in i40e_client_subtask()\n\nCurrently the call to i40e_client_del_instance frees the object\npf->cinst, however pf->cinst->lan_info is being accessed after\nthe free. Fix this by adding the missing return.\n\nAddresses-Coverity: (\"Read from pointer after free\")"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_client.c"], "versions": [{"version": "7b0b1a6d0ac9", "lessThan": "c1322eaeb8af", "status": "affected", "versionType": "git"}, {"version": "7b0b1a6d0ac9", "lessThan": "d718c15a2bf9", "status": "affected", "versionType": "git"}, {"version": "7b0b1a6d0ac9", "lessThan": "829a713450b8", "status": "affected", "versionType": "git"}, {"version": "7b0b1a6d0ac9", "lessThan": "4ebc10aa7cd1", "status": "affected", "versionType": "git"}, {"version": "7b0b1a6d0ac9", "lessThan": "1fd5d262e744", "status": "affected", "versionType": "git"}, {"version": "7b0b1a6d0ac9", "lessThan": "38318f23a7ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_client.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.191", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.120", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.38", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.11.22", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.5", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/c1322eaeb8af0d8985b5cc5fa759140fa0e57b84"}, {"url": "https://git.kernel.org/stable/c/d718c15a2bf9ae082d5ae4d177fb19ef23cb4132"}, {"url": "https://git.kernel.org/stable/c/829a713450b8fb127cbabfc1244c1d8179ec5107"}, {"url": "https://git.kernel.org/stable/c/4ebc10aa7cd17fd9857dedac69600465c9dd16d1"}, {"url": "https://git.kernel.org/stable/c/1fd5d262e7442192ac7611ff1597a36c5b044323"}, {"url": "https://git.kernel.org/stable/c/38318f23a7ef86a8b1862e5e8078c4de121960c3"}], "title": "i40e: Fix use-after-free in i40e_client_subtask()", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-28T20:37:08.164275Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:13:14.823Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:38.447Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c1322eaeb8af0d8985b5cc5fa759140fa0e57b84", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d718c15a2bf9ae082d5ae4d177fb19ef23cb4132", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/829a713450b8fb127cbabfc1244c1d8179ec5107", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4ebc10aa7cd17fd9857dedac69600465c9dd16d1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1fd5d262e7442192ac7611ff1597a36c5b044323", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/38318f23a7ef86a8b1862e5e8078c4de121960c3", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c1322eaeb8af0d8985b5cc5fa759140fa0e57b84", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d718c15a2bf9ae082d5ae4d177fb19ef23cb4132", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/829a713450b8fb127cbabfc1244c1d8179ec5107", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4ebc10aa7cd17fd9857dedac69600465c9dd16d1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1fd5d262e7442192ac7611ff1597a36c5b044323", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/38318f23a7ef86a8b1862e5e8078c4de121960c3", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:38.447Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-28T20:37:08.164275Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:13.836Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "i40e: Fix use-after-free in i40e_client_subtask()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7b0b1a6d0ac9", "lessThan": "c1322eaeb8af", "versionType": "git"}, {"status": "affected", "version": "7b0b1a6d0ac9", "lessThan": "d718c15a2bf9", "versionType": "git"}, {"status": "affected", "version": "7b0b1a6d0ac9", "lessThan": "829a713450b8", "versionType": "git"}, {"status": "affected", "version": "7b0b1a6d0ac9", "lessThan": "4ebc10aa7cd1", "versionType": "git"}, {"status": "affected", "version": "7b0b1a6d0ac9", "lessThan": "1fd5d262e744", "versionType": "git"}, {"status": "affected", "version": "7b0b1a6d0ac9", "lessThan": "38318f23a7ef", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_client.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"status": "unaffected", "version": "0", "lessThan": "4.16", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.191", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.120", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.38", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.11.22", "versionType": "semver", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12.5", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_client.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c1322eaeb8af0d8985b5cc5fa759140fa0e57b84"}, {"url": "https://git.kernel.org/stable/c/d718c15a2bf9ae082d5ae4d177fb19ef23cb4132"}, {"url": "https://git.kernel.org/stable/c/829a713450b8fb127cbabfc1244c1d8179ec5107"}, {"url": "https://git.kernel.org/stable/c/4ebc10aa7cd17fd9857dedac69600465c9dd16d1"}, {"url": "https://git.kernel.org/stable/c/1fd5d262e7442192ac7611ff1597a36c5b044323"}, {"url": "https://git.kernel.org/stable/c/38318f23a7ef86a8b1862e5e8078c4de121960c3"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix use-after-free in i40e_client_subtask()\n\nCurrently the call to i40e_client_del_instance frees the object\npf->cinst, however pf->cinst->lan_info is being accessed after\nthe free. Fix this by adding the missing return.\n\nAddresses-Coverity: (\"Read from pointer after free\")"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:57:16.771Z"}}}, "cveMetadata": {"cveId": "CVE-2021-46991", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:57:16.771Z", "dateReserved": "2024-02-27T18:42:55.949Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-28T08:13:17.195Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}