CVE-2021-47583

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/06/2024
Last modified:
07/11/2024

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: mxl111sf: change mutex_init() location<br /> <br /> Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized<br /> mutex. The problem was in wrong mutex_init() location.<br /> <br /> Previous mutex_init(&amp;state-&gt;msg_lock) call was in -&gt;init() function, but<br /> dvb_usbv2_init() has this order of calls:<br /> <br /> dvb_usbv2_init()<br /> dvb_usbv2_adapter_init()<br /> dvb_usbv2_adapter_frontend_init()<br /> props-&gt;frontend_attach()<br /> <br /> props-&gt;init()<br /> <br /> Since mxl111sf_* devices call mxl111sf_ctrl_msg() in -&gt;frontend_attach()<br /> internally we need to initialize state-&gt;msg_lock before<br /> frontend_attach(). To achieve it, -&gt;probe() call added to all mxl111sf_*<br /> devices, which will simply initiaize mutex.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 3.7 (including) 4.19.222 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.168 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.88 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.11 (excluding)