CVE-2021-46904

{"id": "CVE-2021-46904", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-02-26T16:27:45.260", "references": [{"url": "https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601bee", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hso: fix null-ptr-deref during tty device unregistration\n\nMultiple ttys try to claim the same the minor number causing a double\nunregistration of the same device. The first unregistration succeeds\nbut the next one results in a null-ptr-deref.\n\nThe get_free_serial_index() function returns an available minor number\nbut doesn't assign it immediately. The assignment is done by the caller\nlater. But before this assignment, calls to get_free_serial_index()\nwould return the same minor number.\n\nFix this by modifying get_free_serial_index to assign the minor number\nimmediately after one is found to be and rename it to obtain_minor()\nto better reflect what it does. Similary, rename set_serial_by_index()\nto release_minor() and modify it to free up the minor number of the\ngiven hso_serial. Every obtain_minor() should have corresponding\nrelease_minor() call."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net: hso: corrige null-ptr-deref durante la cancelaci\u00f3n del registro del dispositivo tty. M\u00faltiples ttys intentan reclamar el mismo n\u00famero menor, lo que provoca una doble cancelaci\u00f3n del registro del mismo dispositivo. La primera cancelaci\u00f3n del registro se realiza correctamente, pero la siguiente genera un null-ptr-deref. La funci\u00f3n get_free_serial_index() devuelve un n\u00famero menor disponible pero no lo asigna inmediatamente. La asignaci\u00f3n la realiza la persona que llama m\u00e1s tarde. Pero antes de esta asignaci\u00f3n, las llamadas a get_free_serial_index() devolver\u00edan el mismo n\u00famero menor. Solucione este problema modificando get_free_serial_index para asignar el n\u00famero menor inmediatamente despu\u00e9s de que se encuentre uno y c\u00e1mbiele el nombre a get_minor() para reflejar mejor lo que hace. De manera similar, cambie el nombre de set_serial_by_index() a release_minor() y modif\u00edquelo para liberar el n\u00famero menor del hso_serial dado. Cada get_minor() debe tener la llamada release_minor() correspondiente."}], "lastModified": "2024-04-17T19:33:10.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "659FF119-13E0-486C-96F2-C0126F87D0CB", "versionEndExcluding": "4.4.268", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DBC0886-BE0B-4CA4-AF1B-531144C8BE34", "versionEndExcluding": "4.9.268", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "316D2418-B6F3-454C-AA83-1577F40CFABA", "versionEndExcluding": "4.14.232", "versionStartIncluding": "4.10.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "123664FC-5EE8-4D91-9E83-09583F5FDDCF", "versionEndExcluding": "4.19.187", "versionStartIncluding": "4.15.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FDB5646-9EDD-4F92-BF93-0F19CF52612D", "versionEndExcluding": "5.4.112", "versionStartIncluding": "4.20.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05B46463-5756-48FE-AC75-227FB4CA982B", "versionEndExcluding": "5.10.30", "versionStartIncluding": "5.5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91BEA1D8-08CA-4B9C-9A3C-7856507EC311", "versionEndExcluding": "5.11.14", "versionStartIncluding": "5.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}