In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: fix memory leak in nci_allocate_device

nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev.
Fix this by freeing hci_dev in nci_free_device.

BUG: memory leak
unreferenced object 0xffff888111ea6800 (size 1024):
comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline]
[<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline]
[<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784
[<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline]
[<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132
[<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153
[<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345
[<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554
[<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740
[<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846
[<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914
[<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109
[<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
[<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
11f54f228643d0248ec00ce8c9fb8d872f87e7b8 affected < 448a1cb12977f52142e6feb12022c59662d88dc1
11f54f228643d0248ec00ce8c9fb8d872f87e7b8 affected < 4a621621c7af3cec21c47c349b30cd9c3cea11c8
11f54f228643d0248ec00ce8c9fb8d872f87e7b8 affected < 2c2fb2df46ea866b49fea5ec7112ec3cd4896c74
11f54f228643d0248ec00ce8c9fb8d872f87e7b8 affected < 0365701bc44e078682ee1224866a71897495c7ef
11f54f228643d0248ec00ce8c9fb8d872f87e7b8 affected < af2a4426baf71163c0c354580ae98c7888a9aba7
11f54f228643d0248ec00ce8c9fb8d872f87e7b8 affected < b34cb7ac32cc8e5471dc773180ea9ae676b1a745
11f54f228643d0248ec00ce8c9fb8d872f87e7b8 affected < 65234f50a90b64b335cbb9164b8a98c2a0d031dd
11f54f228643d0248ec00ce8c9fb8d872f87e7b8 affected < e0652f8bb44d6294eeeac06d703185357f25d50b
Linux Linux affected
Version Status Constraints
4.0 affected —
0 unaffected < 4.0
4.4.271 unaffected ≤ 4.4.*
4.9.271 unaffected ≤ 4.9.*
4.14.235 unaffected ≤ 4.14.*
4.19.193 unaffected ≤ 4.19.*
5.4.123 unaffected ≤ 5.4.*
5.10.41 unaffected ≤ 5.10.*
5.12.8 unaffected ≤ 5.12.*
5.13 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0365701bc44e078682ee1224866a71897495c7ef cve-icon cve-icon
https://git.kernel.org/stable/c/2c2fb2df46ea866b49fea5ec7112ec3cd4896c74 cve-icon cve-icon
https://git.kernel.org/stable/c/448a1cb12977f52142e6feb12022c59662d88dc1 cve-icon cve-icon
https://git.kernel.org/stable/c/4a621621c7af3cec21c47c349b30cd9c3cea11c8 cve-icon cve-icon
https://git.kernel.org/stable/c/65234f50a90b64b335cbb9164b8a98c2a0d031dd cve-icon cve-icon
https://git.kernel.org/stable/c/af2a4426baf71163c0c354580ae98c7888a9aba7 cve-icon cve-icon
https://git.kernel.org/stable/c/b34cb7ac32cc8e5471dc773180ea9ae676b1a745 cve-icon cve-icon
https://git.kernel.org/stable/c/e0652f8bb44d6294eeeac06d703185357f25d50b cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024032539-CVE-2021-47180-5b80@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47180 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47180 cve-icon
History

Tue, 07 Jan 2025 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Mon, 04 Nov 2024 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 20 Sep 2024 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400 CWE-401
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:05:50.928Z

Reserved: 2024-03-25T09:12:14.112Z

Link: CVE-2021-47180

cve-icon Vulnrichment

Updated: 2024-08-04T05:32:07.250Z

cve-icon NVD

Status : Analyzed

Published: 2024-03-25T10:15:09.363

Modified: 2025-01-07T17:17:24.333

Link: CVE-2021-47180

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-03-25T00:00:00Z

Links: CVE-2021-47180 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses