CVE-2021-47416

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/05/2024
Last modified:
31/12/2024

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> phy: mdio: fix memory leak<br /> <br /> Syzbot reported memory leak in MDIO bus interface, the problem was in<br /> wrong state logic.<br /> <br /> MDIOBUS_ALLOCATED indicates 2 states:<br /> 1. Bus is only allocated<br /> 2. Bus allocated and __mdiobus_register() fails, but<br /> device_register() was called<br /> <br /> In case of device_register() has been called we should call put_device()<br /> to correctly free the memory allocated for this device, but mdiobus_free()<br /> calls just kfree(dev) in case of MDIOBUS_ALLOCATED state<br /> <br /> To avoid this behaviour we need to set bus-&gt;state to MDIOBUS_UNREGISTERED<br /> _before_ calling device_register(), because put_device() should be<br /> called even in case of device_register() failure.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 2.6.28 (including) 4.4.289 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.5 (including) 4.9.287 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.10 (including) 4.14.251 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.15 (including) 4.19.211 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.153 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.73 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.14.12 (excluding)
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*