Linux Kernel up to 5.15.23/5.16.9 SUNRPC rpc_sysfs_xprt_kobj_get_xprt reference count

Summaryinfo

A vulnerability described as problematic has been identified in Linux Kernel up to 5.15.23/5.16.9. Impacted is the function rpc_sysfs_xprt_kobj_get_xprt of the component SUNRPC. The manipulation results in reference count. This vulnerability is cataloged as CVE-2021-47624. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.15.23/5.16.9. Affected is the function rpc_sysfs_xprt_kobj_get_xprt of the component SUNRPC. The manipulation with an unknown input leads to a reference count vulnerability. CWE is classifying the issue as CWE-911. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change The refcount leak issues take place in an error handling path. When the 3rd argument buf doesn't match with "offline", "online" or "remove", the function simply returns -EINVAL and forgets to decrease the reference count of a rpc_xprt object and a rpc_xprt_switch object increased by rpc_sysfs_xprt_kobj_get_xprt() and rpc_sysfs_xprt_kobj_get_xprt_switch(), causing reference count leaks of both unused objects. Fix this issue by jumping to the error handling path labelled with out_put when buf matches none of "offline", "online" or "remove".

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2021-47624 since 07/16/2024. There are known technical details, but no exploit is available.

Upgrading to version 5.15.24 or 5.16.10 eliminates this vulnerability. Applying the patch 4b22aa42bd4d/5f6024c05a2c/776d794f28c9 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7
• 5.16.8
• 5.16.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion