Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-46905
HistoryFeb 26, 2024 - 12:00 a.m.

CVE-2021-46905

2024-02-2600:00:00
ubuntu.com
ubuntu.com
7
linux kernel
net
hso
vulnerability
fix
null-deref
disconnect
regression
commit
syzbot
serial device
table
minor allocation
release

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

In the Linux kernel, the following vulnerability has been resolved: net:
hso: fix NULL-deref on disconnect regression Commit 8a12f8836145 (“net:
hso: fix null-ptr-deref during tty device unregistration”) fixed the racy
minor allocation reported by syzbot, but introduced an unconditional
NULL-pointer dereference on every disconnect instead. Specifically, the
serial device table must no longer be accessed after the minor has been
released by hso_serial_tty_unregister().

Notes

Author Note
rodrigo-zaiden break commit for this issue is the fix commit for CVE-2021-46904. maybe it could be just one CVE as the resulting issue seems to be the same.

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%