Linux Kernel up to 5.12.6 gaudi hl_cb_kernel_create of use after free

Summaryinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.12.6. Impacted is the function hl_cb_kernel_create of the component gaudi. Such manipulation of the argument of leads to use after free. This vulnerability is listed as CVE-2021-47081. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 5.12.6 (Operating System). Affected by this issue is the function hl_cb_kernel_create of the component gaudi. The manipulation of the argument of with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memory Our code analyzer reported a uaf. In gaudi_memset_device_memory, cb is get via hl_cb_kernel_create() with 2 refcount. If hl_cs_allocate_job() failed, the execution runs into release_cb branch. One ref of cb is dropped by hl_cb_put(cb) and could be freed if other thread also drops one ref. Then cb is used by cb->id later, which is a potential uaf. My patch add a variable 'id' to accept the value of cb->id before the hl_cb_put(cb) is called, to avoid the potential uaf.

The weakness was presented 03/02/2024. The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2021-47081 since 02/29/2024. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 12/10/2024).

Upgrading to version 5.12.7 or 5.13 eliminates this vulnerability. Applying the patch b49f5af30b0e/115726c5d312 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3
• 5.12.4
• 5.12.5
• 5.12.6

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion