CVE-2021-47239
HIGHLinux Kernel 4.4.271-4.4.273 - Use-After-Free in smsc75xx_bind
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: net: usb: fix possible use-after-free in smsc75xx_bind The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind") fails to clean up the work scheduled in smsc75xx_reset-> smsc75xx_set_multicast, which leads to use-after-free if the work is scheduled to start after the deallocation. In addition, this patch also removes a dangling pointer - dev->data[0]. This patch calls cancel_work_sync to cancel the scheduled work and set the dangling pointer to NULL.
References (8)
Core 8
Core References
Scores
CVSS v3
7.8
EPSS
0.0023
EPSS Percentile
13.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-416
Status
published
Products (16)
Linux/Linux
200dbfcad8011e50c3cec269ed7b980836eeb1fa - 7cc8b2e05fcea6edd022d26e82091d781af8fd9b
Linux/Linux
22c840596af0c09068b6cf948616e6496e59e07f - 64160d1741a3de5204d1a822e058e0b4cc526504
Linux/Linux
4.14.235 - 4.14.238
Linux/Linux
4.19.193 - 4.19.196
Linux/Linux
4.4.271 - 4.4.274
Linux/Linux
4.9.271 - 4.9.274
Linux/Linux
46a8b29c6306d8bbfd92b614ef65a47c900d8e70 - 56b786d86694e079d8aad9b314e015cd4ac02a3d
Linux/Linux
5.10.42 - 5.10.46
Linux/Linux
5.12.9 - 5.12.13
Linux/Linux
5.4.124 - 5.4.128
... and 6 more
Published
May 21, 2024
Tracked Since
Feb 18, 2026