In the Linux kernel, the following vulnerability has been resolved:

net: usb: fix possible use-after-free in smsc75xx_bind

The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind")
fails to clean up the work scheduled in smsc75xx_reset->
smsc75xx_set_multicast, which leads to use-after-free if the work is
scheduled to start after the deallocation. In addition, this patch
also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set
the dangling pointer to NULL.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
200dbfcad8011e50c3cec269ed7b980836eeb1fa affected
< 7cc8b2e05fcea6edd022d26e82091d781af8fd9b
22c840596af0c09068b6cf948616e6496e59e07f affected
< 64160d1741a3de5204d1a822e058e0b4cc526504
9e6b8c1ff9d997e1fa16cbd2d60739adf6dc1bbc affected
< c4e3be2e7742863e454ce31faf8fd0109c00050b
9e6a3eccb28779710cbbafc4f4258d92509c6d07 affected
< 2fc8300c9cfa5167fcb5b1a2a07db6f53e82f59b
b95fb96e6339e34694dd578fb6bde3575b01af17 affected
< 4252bf6c2b245f47011098113d405ffad6ad5d5b
635ac38b36255d3cfb8312cf7c471334f4d537e0 affected
< 570a52cf3e01d19f7fd1a251dfc52b0cd86c13cb
70c886ac93f87ae7214a0c69151a28a8075dd95b affected
< 14616c372a7be01a2fb8c56c9d8debd232b9e43d
46a8b29c6306d8bbfd92b614ef65a47c900d8e70 affected
< 56b786d86694e079d8aad9b314e015cd4ac02a3d
Linux Linux unaffected
Version Status Constraints
4.4.271 affected
< 4.4.274
4.9.271 affected
< 4.9.274
4.14.235 affected
< 4.14.238
4.19.193 affected
< 4.19.196
5.4.124 affected
< 5.4.128
5.10.42 affected
< 5.10.46
5.12.9 affected
< 5.12.13

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/14616c372a7be01a2fb8c56c9d8debd232b9e43d cve-icon cve-icon
https://git.kernel.org/stable/c/2fc8300c9cfa5167fcb5b1a2a07db6f53e82f59b cve-icon cve-icon
https://git.kernel.org/stable/c/4252bf6c2b245f47011098113d405ffad6ad5d5b cve-icon cve-icon
https://git.kernel.org/stable/c/56b786d86694e079d8aad9b314e015cd4ac02a3d cve-icon cve-icon
https://git.kernel.org/stable/c/570a52cf3e01d19f7fd1a251dfc52b0cd86c13cb cve-icon cve-icon
https://git.kernel.org/stable/c/64160d1741a3de5204d1a822e058e0b4cc526504 cve-icon cve-icon
https://git.kernel.org/stable/c/7cc8b2e05fcea6edd022d26e82091d781af8fd9b cve-icon cve-icon
https://git.kernel.org/stable/c/c4e3be2e7742863e454ce31faf8fd0109c00050b cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024052141-CVE-2021-47239-ae00@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47239 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47239 cve-icon
History

Mon, 30 Dec 2024 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 04 Nov 2024 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:06:56.591Z

Reserved: 2024-04-10T18:59:19.532Z

Link: CVE-2021-47239

cve-icon Vulnrichment

Updated: 2024-08-04T05:32:07.920Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-21T15:15:13.100

Modified: 2024-12-30T19:05:15.167

Link: CVE-2021-47239

cve-icon Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2021-47239 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses