CVE-2021-47482

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47482

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net: batman-adv: fix error handling Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was in wrong error handling in batadv_mesh_init(). Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case of any batadv_*_init() calls failure. This approach may work well, when there is some kind of indicator, which can tell which parts of batadv are initialized; but there isn't any. All written above lead to cleaning up uninitialized fields. Even if we hide ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1] To fix these bugs we can unwind batadv_*_init() calls one by one. It is good approach for 2 reasons: 1) It fixes bugs on error handling path 2) It improves the performance, since we won't call unneeded batadv_*_free() functions. So, this patch makes all batadv_*_init() clean up all allocated memory before returning with an error to no call correspoing batadv_*_free() and open-codes batadv_mesh_free() with proper order to avoid touching uninitialized fields.

References
Link Resource
https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20 Patch
https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73 Patch
https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e Patch
https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68 Patch
https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347 Patch
https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8 Patch
https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00 Patch
https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51 Patch
https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20 Patch
https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73 Patch
https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e Patch
https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68 Patch
https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347 Patch
https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8 Patch
https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00 Patch
https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*
History

02 Apr 2025, 15:09

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20 - () https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20 - Patch
References () https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73 - () https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73 - Patch
References () https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e - () https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e - Patch
References () https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68 - () https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68 - Patch
References () https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347 - () https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347 - Patch
References () https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8 - () https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8 - Patch
References () https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00 - () https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00 - Patch
References () https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51 - () https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51 - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*

21 Nov 2024, 06:36

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20 - () https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20 -
References () https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73 - () https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73 -
References () https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e - () https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e -
References () https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68 - () https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68 -
References () https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347 - () https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347 -
References () https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8 - () https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8 -
References () https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00 - () https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00 -
References () https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51 - () https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51 -

03 Jul 2024, 01:38

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-544
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: batman-adv: corrección de manejo de errores Syzbot informó advertencia ODEBUG en batadv_nc_mesh_free(). El problema estaba en el manejo incorrecto de errores en batadv_mesh_init(). Antes de este parche, batadv_mesh_init() llamaba a batadv_mesh_free() en caso de que fallara alguna llamada a batadv_*_init(). Este enfoque puede funcionar bien cuando hay algún tipo de indicador que puede indicar qué partes de batadv están inicializadas; pero no hay ninguno. Todo lo escrito anteriormente conduce a la sanitización de campos no inicializados. Incluso si ocultamos la advertencia ODEBUG inicializando bat_priv->nc.work, syzbot pudo presionar GPF en batadv_nc_purge_paths(), porque el puntero hash todavía es NULL. [1] Para corregir estos errores podemos desenredar las llamadas batadv_*_init() una por una. Es un buen enfoque por 2 razones: 1) Corrige errores en la ruta de manejo de errores 2) Mejora el rendimiento, ya que no llamaremos a funciones batadv_*_free() innecesarias. Entonces, este parche hace que batadv_*_init() limpie toda la memoria asignada antes de regresar con un error de no llamada correspondiente a batadv_*_free() y códigos abiertos batadv_mesh_free() con el orden adecuado para evitar tocar campos no inicializados.

22 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 09:15

Updated : 2025-04-02 15:09

NVD link : CVE-2021-47482

Mitre link : CVE-2021-47482

CVE.ORG link : CVE-2021-47482

JSON object : View

Products Affected

linux

CWE
CWE-544

Missing Standardized Error Handling Mechanism