Linux Kernel up to 5.11.21/5.12.4 iio iio_device_unregister denial of service

Summaryinfo

A vulnerability classified as critical was found in Linux Kernel up to 5.11.21/5.12.4. Affected by this vulnerability is the function iio_device_unregister of the component iio. The manipulation results in denial of service. This vulnerability is cataloged as CVE-2021-46979. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 5.11.21/5.12.4 (Operating System). Affected is the function iio_device_unregister of the component iio. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix ioctl handlers removal Currently ioctl handlers are removed twice. For the first time during iio_device_unregister() then later on inside iio_device_unregister_eventset() and iio_buffers_free_sysfs_and_mask(). Double free leads to kernel panic. Fix this by not touching ioctl handlers list directly but rather letting code responsible for registration call the matching cleanup routine itself.

The weakness was shared 02/28/2024. The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2021-46979 since 02/27/2024. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 246381 (Linux Distros Unpatched Vulnerability : CVE-2021-46979), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.11.22, 5.12.5 or 5.13 eliminates this vulnerability. Applying the patch 11e1cae5da40/ab6c935ba3a0/901f84de0e16 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (246381). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.11.0
• 5.11.1
• 5.11.2
• 5.11.3
• 5.11.4
• 5.11.5
• 5.11.6
• 5.11.7
• 5.11.8
• 5.11.9
• 5.11.10
• 5.11.11
• 5.11.12
• 5.11.13
• 5.11.14
• 5.11.15
• 5.11.16
• 5.11.17
• 5.11.18
• 5.11.19
• 5.11.20
• 5.11.21
• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3
• 5.12.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion