CVE-2021-47519

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47519

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_read_fifo: fix memory leak in error branch In m_can_read_fifo(), if the second call to m_can_fifo_read() fails, the function jump to the out_fail label and returns without calling m_can_receive_skb(). This means that the skb previously allocated by alloc_can_skb() is not freed. In other terms, this is a memory leak. This patch adds a goto label to destroy the skb if an error occurs. Issue was found with GCC -fanalyzer, please follow the link below for details.

References
Link Resource
https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56 Patch
https://git.kernel.org/stable/c/75a422165477dd12d2d20aa7c9ee7c9a281c9908 Patch
https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56 Patch
https://git.kernel.org/stable/c/75a422165477dd12d2d20aa7c9ee7c9a281c9908 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 06:36

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56 - Patch () https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56 - Patch
References () https://git.kernel.org/stable/c/75a422165477dd12d2d20aa7c9ee7c9a281c9908 - Patch () https://git.kernel.org/stable/c/75a422165477dd12d2d20aa7c9ee7c9a281c9908 - Patch

10 Jun 2024, 18:43

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: m_can: m_can_read_fifo: corrige la pérdida de memoria en la rama de error En m_can_read_fifo(), si la segunda llamada a m_can_fifo_read() falla, la función salta a la etiqueta out_fail y regresa sin llamar m_can_receive_skb(). Esto significa que el skb previamente asignado por alloc_can_skb() no se libera. En otras palabras, se trata de una pérdida de memoria. Este parche agrega una etiqueta goto para destruir el skb si ocurre un error. Se encontró un problema con GCC -fanalyzer; siga el enlace a continuación para obtener más detalles.
References () https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56 - () https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56 - Patch
References () https://git.kernel.org/stable/c/75a422165477dd12d2d20aa7c9ee7c9a281c9908 - () https://git.kernel.org/stable/c/75a422165477dd12d2d20aa7c9ee7c9a281c9908 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-401

24 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-24 15:15

Updated : 2024-11-21 06:36

NVD link : CVE-2021-47519

Mitre link : CVE-2021-47519

CVE.ORG link : CVE-2021-47519

JSON object : View

Products Affected

linux

CWE
CWE-401

Missing Release of Memory after Effective Lifetime