CVE-2021-47482

{"id": "CVE-2021-47482", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2024-05-22T09:15:10.150", "references": [{"url": "https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-544"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: batman-adv: fix error handling\n\nSyzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was\nin wrong error handling in batadv_mesh_init().\n\nBefore this patch batadv_mesh_init() was calling batadv_mesh_free() in case\nof any batadv_*_init() calls failure. This approach may work well, when\nthere is some kind of indicator, which can tell which parts of batadv are\ninitialized; but there isn't any.\n\nAll written above lead to cleaning up uninitialized fields. Even if we hide\nODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit\nGPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]\n\nTo fix these bugs we can unwind batadv_*_init() calls one by one.\nIt is good approach for 2 reasons: 1) It fixes bugs on error handling\npath 2) It improves the performance, since we won't call unneeded\nbatadv_*_free() functions.\n\nSo, this patch makes all batadv_*_init() clean up all allocated memory\nbefore returning with an error to no call correspoing batadv_*_free()\nand open-codes batadv_mesh_free() with proper order to avoid touching\nuninitialized fields."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: batman-adv: correcci\u00f3n de manejo de errores Syzbot inform\u00f3 advertencia ODEBUG en batadv_nc_mesh_free(). El problema estaba en el manejo incorrecto de errores en batadv_mesh_init(). Antes de este parche, batadv_mesh_init() llamaba a batadv_mesh_free() en caso de que fallara alguna llamada a batadv_*_init(). Este enfoque puede funcionar bien cuando hay alg\u00fan tipo de indicador que puede indicar qu\u00e9 partes de batadv est\u00e1n inicializadas; pero no hay ninguno. Todo lo escrito anteriormente conduce a la sanitizaci\u00f3n de campos no inicializados. Incluso si ocultamos la advertencia ODEBUG inicializando bat_priv->nc.work, syzbot pudo presionar GPF en batadv_nc_purge_paths(), porque el puntero hash todav\u00eda es NULL. [1] Para corregir estos errores podemos desenredar las llamadas batadv_*_init() una por una. Es un buen enfoque por 2 razones: 1) Corrige errores en la ruta de manejo de errores 2) Mejora el rendimiento, ya que no llamaremos a funciones batadv_*_free() innecesarias. Entonces, este parche hace que batadv_*_init() limpie toda la memoria asignada antes de regresar con un error de no llamada correspondiente a batadv_*_free() y c\u00f3digos abiertos batadv_mesh_free() con el orden adecuado para evitar tocar campos no inicializados."}], "lastModified": "2024-07-03T01:38:01.587", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}