Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-47456
HistoryMay 22, 2024 - 12:00 a.m.

CVE-2021-47456

2024-05-2200:00:00
ubuntu.com
ubuntu.com
1
linux kernel
peak_pci
uaf vulnerability

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.0%

In the Linux kernel, the following vulnerability has been resolved: can:
peak_pci: peak_pci_remove(): fix UAF When remove the module peek_pci,
referencing ‘chan’ again after releasing ‘dev’ will cause UAF. Fix this by
releasing ‘dev’ later. The following log reveals it: [ 35.961814 ] BUG:
KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.963414
] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537 [ 35.965513
] Call Trace: [ 35.965718 ] dump_stack_lvl+0xa8/0xd1 [ 35.966028 ]
print_address_description+0x87/0x3b0 [ 35.966420 ] kasan_report+0x172/0x1c0
[ 35.966725 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967137 ] ?
trace_irq_enable_rcuidle+0x10/0x170 [ 35.967529 ] ?
peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967945 ]
__asan_report_load8_noabort+0x14/0x20 [ 35.968346 ]
peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.968752 ]
pci_device_remove+0xa9/0x250

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.0%