Lucene search

K
nvd416baaa9-dc9f-4396-8d5f-8c081fb06d67NVD:CVE-2021-47334
HistoryMay 21, 2024 - 3:15 p.m.

CVE-2021-47334

2024-05-2115:15:20
416baaa9-dc9f-4396-8d5f-8c081fb06d67
web.nvd.nist.gov
linux kernel
vulnerability
cve-2021-47334
use after free
ibmasm_init_one
input_allocate_device
error branch

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.2%

In the Linux kernel, the following vulnerability has been resolved:

misc/libmasm/module: Fix two use after free in ibmasm_init_one

In ibmasm_init_one, it calls ibmasm_init_remote_input_dev().
Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are
allocated by input_allocate_device(), and assigned to
sp->remote.mouse_dev and sp->remote.keybd_dev respectively.

In the err_free_devices error branch of ibmasm_init_one,
mouse_dev and keybd_dev are freed by input_free_device(), and return
error. Then the execution runs into error_send_message error branch
of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called
to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.

My patch add a “error_init_remote” label to handle the error of
ibmasm_init_remote_input_dev(), to avoid the uaf bugs.

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.2%