CVE-2021-47081
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
01/03/2024
Last modified:
09/12/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memory<br />
<br />
Our code analyzer reported a uaf.<br />
<br />
In gaudi_memset_device_memory, cb is get via hl_cb_kernel_create()<br />
with 2 refcount.<br />
If hl_cs_allocate_job() failed, the execution runs into release_cb<br />
branch. One ref of cb is dropped by hl_cb_put(cb) and could be freed<br />
if other thread also drops one ref. Then cb is used by cb->id later,<br />
which is a potential uaf.<br />
<br />
My patch add a variable &#39;id&#39; to accept the value of cb->id before the<br />
hl_cb_put(cb) is called, to avoid the potential uaf.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.12 (including) | 5.12.7 (excluding) |
| cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page