CVE-2021-46904
Vulnerability from cvelistv5
Published
2024-02-25 14:03
Modified
2024-12-19 07:31
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref. The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number. Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601beePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72acPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601beePatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152aPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72acPatch
Impacted products
Vendor Product Version
Linux Linux Version: 2.6.27
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-25T17:47:17.588165Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-25T17:47:30.417Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.846Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601bee"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/hso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a462067d7c8e6953a733bf5ade8db947b1bb5449",
              "status": "affected",
              "version": "72dc1c096c7051a48ab1dbb12f71976656b55eb5",
              "versionType": "git"
            },
            {
              "lessThan": "145c89c441d27696961752bf51b323f347601bee",
              "status": "affected",
              "version": "72dc1c096c7051a48ab1dbb12f71976656b55eb5",
              "versionType": "git"
            },
            {
              "lessThan": "caf5ac93b3b5d5fac032fc11fbea680e115421b4",
              "status": "affected",
              "version": "72dc1c096c7051a48ab1dbb12f71976656b55eb5",
              "versionType": "git"
            },
            {
              "lessThan": "92028d7a31e55d53e41cff679156b9432cffcb36",
              "status": "affected",
              "version": "72dc1c096c7051a48ab1dbb12f71976656b55eb5",
              "versionType": "git"
            },
            {
              "lessThan": "4a2933c88399c0ebc738db39bbce3ae89786d723",
              "status": "affected",
              "version": "72dc1c096c7051a48ab1dbb12f71976656b55eb5",
              "versionType": "git"
            },
            {
              "lessThan": "dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac",
              "status": "affected",
              "version": "72dc1c096c7051a48ab1dbb12f71976656b55eb5",
              "versionType": "git"
            },
            {
              "lessThan": "388d05f70f1ee0cac4a2068fd295072f1a44152a",
              "status": "affected",
              "version": "72dc1c096c7051a48ab1dbb12f71976656b55eb5",
              "versionType": "git"
            },
            {
              "lessThan": "8a12f8836145ffe37e9c8733dce18c22fb668b66",
              "status": "affected",
              "version": "72dc1c096c7051a48ab1dbb12f71976656b55eb5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/hso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.232",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hso: fix null-ptr-deref during tty device unregistration\n\nMultiple ttys try to claim the same the minor number causing a double\nunregistration of the same device. The first unregistration succeeds\nbut the next one results in a null-ptr-deref.\n\nThe get_free_serial_index() function returns an available minor number\nbut doesn\u0027t assign it immediately. The assignment is done by the caller\nlater. But before this assignment, calls to get_free_serial_index()\nwould return the same minor number.\n\nFix this by modifying get_free_serial_index to assign the minor number\nimmediately after one is found to be and rename it to obtain_minor()\nto better reflect what it does. Similary, rename set_serial_by_index()\nto release_minor() and modify it to free up the minor number of the\ngiven hso_serial. Every obtain_minor() should have corresponding\nrelease_minor() call."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T07:31:31.978Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449"
        },
        {
          "url": "https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601bee"
        },
        {
          "url": "https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66"
        }
      ],
      "title": "net: hso: fix null-ptr-deref during tty device unregistration",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46904",
    "datePublished": "2024-02-25T14:03:40.319Z",
    "dateReserved": "2024-02-25T13:45:52.716Z",
    "dateUpdated": "2024-12-19T07:31:31.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-46904\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-26T16:27:45.260\",\"lastModified\":\"2024-11-21T06:34:53.943\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: hso: fix null-ptr-deref during tty device unregistration\\n\\nMultiple ttys try to claim the same the minor number causing a double\\nunregistration of the same device. The first unregistration succeeds\\nbut the next one results in a null-ptr-deref.\\n\\nThe get_free_serial_index() function returns an available minor number\\nbut doesn\u0027t assign it immediately. The assignment is done by the caller\\nlater. But before this assignment, calls to get_free_serial_index()\\nwould return the same minor number.\\n\\nFix this by modifying get_free_serial_index to assign the minor number\\nimmediately after one is found to be and rename it to obtain_minor()\\nto better reflect what it does. Similary, rename set_serial_by_index()\\nto release_minor() and modify it to free up the minor number of the\\ngiven hso_serial. Every obtain_minor() should have corresponding\\nrelease_minor() call.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net: hso: corrige null-ptr-deref durante la cancelaci\u00f3n del registro del dispositivo tty. M\u00faltiples ttys intentan reclamar el mismo n\u00famero menor, lo que provoca una doble cancelaci\u00f3n del registro del mismo dispositivo. La primera cancelaci\u00f3n del registro se realiza correctamente, pero la siguiente genera un null-ptr-deref. La funci\u00f3n get_free_serial_index() devuelve un n\u00famero menor disponible pero no lo asigna inmediatamente. La asignaci\u00f3n la realiza la persona que llama m\u00e1s tarde. Pero antes de esta asignaci\u00f3n, las llamadas a get_free_serial_index() devolver\u00edan el mismo n\u00famero menor. Solucione este problema modificando get_free_serial_index para asignar el n\u00famero menor inmediatamente despu\u00e9s de que se encuentre uno y c\u00e1mbiele el nombre a get_minor() para reflejar mejor lo que hace. De manera similar, cambie el nombre de set_serial_by_index() a release_minor() y modif\u00edquelo para liberar el n\u00famero menor del hso_serial dado. Cada get_minor() debe tener la llamada release_minor() correspondiente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.27\",\"versionEndExcluding\":\"4.4.268\",\"matchCriteriaId\":\"659FF119-13E0-486C-96F2-C0126F87D0CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5.0\",\"versionEndExcluding\":\"4.9.268\",\"matchCriteriaId\":\"2DBC0886-BE0B-4CA4-AF1B-531144C8BE34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10.0\",\"versionEndExcluding\":\"4.14.232\",\"matchCriteriaId\":\"316D2418-B6F3-454C-AA83-1577F40CFABA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15.0\",\"versionEndExcluding\":\"4.19.187\",\"matchCriteriaId\":\"123664FC-5EE8-4D91-9E83-09583F5FDDCF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20.0\",\"versionEndExcluding\":\"5.4.112\",\"matchCriteriaId\":\"7FDB5646-9EDD-4F92-BF93-0F19CF52612D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5.0\",\"versionEndExcluding\":\"5.10.30\",\"matchCriteriaId\":\"05B46463-5756-48FE-AC75-227FB4CA982B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.0\",\"versionEndExcluding\":\"5.11.14\",\"matchCriteriaId\":\"91BEA1D8-08CA-4B9C-9A3C-7856507EC311\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601bee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601bee\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.