CVE-2021-47334

misc/libmasm/module: Fix two use after free in ibmasm_init_one

published May 21, 2024

CVSS
—
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

misc/libmasm/module: Fix two use after free in ibmasm_init_one

In ibmasm_init_one, it calls ibmasm_init_remote_input_dev().

Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are

allocated by input_allocate_device(), and assigned to

sp->remote.mouse_dev and sp->remote.keybd_dev respectively.

In the err_free_devices error branch of ibmasm_init_one,

mouse_dev and keybd_dev are freed by input_free_device(), and return

error. Then the execution runs into error_send_message error branch

of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called

to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.

My patch add a "error_init_remote" label to handle the error of

ibmasm_init_remote_input_dev(), to avoid the uaf bugs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Published
2024-05-21T14:35Z
EPSS history
Timeline
  • 21 MAY 14:35Z
    misc/libmasm/module: Fix two use after free in ibmasm_init_one
    cvelistv5