CVE-2021-46959: spi: Fix use-after-free with devm_spi_alloc_*

Q: What is the severity of CVE-2021-46959?

CVE-2021-46959 has a moderate severity level due to the potential for use-after-free vulnerabilities in the Linux kernel.

Q: How do I fix CVE-2021-46959?

To resolve CVE-2021-46959, update your Linux kernel to a version that is not affected, specifically versions that are higher than 4.4.271, 4.9.271, 4.14.233, 4.19.191, 5.4.119, 5.10.37, 5.11.21, and 5.12.4.

Q: Which versions of the Linux kernel are affected by CVE-2021-46959?

CVE-2021-46959 affects Linux kernel versions 4.4.248 to 4.4.271, 4.9.248 to 4.9.271, 4.14.212 to 4.14.233, 4.19.163 to 4.19.191, 5.4.80 to 5.4.119, 5.10 to 5.10.37, 5.11 to 5.11.21, and 5.12 to 5.12.4.

Q: What is a use-after-free vulnerability as seen in CVE-2021-46959?

A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, leading to potential exploitation.

Q: What components are involved in CVE-2021-46959?

CVE-2021-46959 specifically involves the SPI subsystem of the Linux kernel, particularly due to the improper handling of resource management during device unregistration.

Published Feb 29, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved:

spi: Fix use-after-free with devmspialloc

We can't rely on the contents of the devres list during spiunregistercontroller(), as the list is already torn down at the time we perform devresfind() for devmspireleasecontroller. This causes devices registered with devmspialloc{master,slave}() to be mistakenly identified as legacy, non-devm managed devices and have their reference counters decremented below 0.

------------[ cut here ]------------ WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcountwarnsaturate+0x108/0x174 [<b0396f04>] (refcountwarnsaturate) from [<b03c56a4>] (kobjectput+0x90/0x98) [<b03c5614>] (kobjectput) from [<b0447b4c>] (putdevice+0x20/0x24) r4:b6700140 [<b0447b2c>] (putdevice) from [<b07515e8>] (devmspireleasecontroller+0x3c/0x40) [<b07515ac>] (devmspireleasecontroller) from [<b045343c>] (releasenodes+0x84/0xc4) r5:b6700180 r4:b6700100 [<b04533b8>] (releasenodes) from [<b0454160>] (devresreleaseall+0x5c/0x60) r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10 [<b0454104>] (devresreleaseall) from [<b044e41c>] (devicereleasedriver+0x144/0x1ec) r5:b117ad94 r4:b163dc10 [<b044e2d8>] (devicereleasedriver) from [<b044f70c>] (devicedriverdetach+0x84/0xa0) r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10 [<b044f688>] (devicedriverdetach) from [<b044d274>] (unbindstore+0xe4/0xf8)

Instead, determine the devm allocation state as a flag on the controller which is guaranteed to be stable during cleanup.

Affected Software

113 affected componentsFixes available

Linux Linux kernel>=4.4.248<4.4.271

Linux Linux kernel>=4.9.248<4.9.271

Linux Linux kernel>=4.14.212<4.14.233

Linux Linux kernel>=4.19.163<4.19.191

Linux Linux kernel>=5.4.80<5.4.119

Linux Linux kernel>=5.10<5.10.37

Linux Linux kernel>=5.11<5.11.21

Linux Linux kernel>=5.12<5.12.4

ubuntu/linux-azure<4.15.0-1121.134~14.04.1

4.15.0-1121.134~14.04.1

ubuntu/linux-aws<4.4.0-1143.149

4.4.0-1143.149

ubuntu/linux-lts-xenial<4.4.0-268.302~14.04.1

4.4.0-268.302~14.04.1

ubuntu/linux<4.4.0-268.302

4.4.0-268.302

ubuntu/linux-aws<4.4.0-1181.196

4.4.0-1181.196

ubuntu/linux-aws-hwe<4.15.0-1109.116~16.04.1

4.15.0-1109.116~16.04.1

ubuntu/linux-azure<4.15.0-1121.134~16.04.1

4.15.0-1121.134~16.04.1

ubuntu/linux-gcp<4.15.0-1106.120~16.04.1

4.15.0-1106.120~16.04.1

ubuntu/linux-hwe<4.15.0-151.157~16.04.1

4.15.0-151.157~16.04.1

ubuntu/linux-kvm<4.4.0-1144.155

4.4.0-1144.155

ubuntu/linux-oracle<4.15.0-1078.86~16.04.1

4.15.0-1078.86~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1113.120

4.4.0-1113.120

ubuntu/linux<4.15.0-151.157

4.15.0-151.157

ubuntu/linux-aws<4.15.0-1109.116

4.15.0-1109.116

ubuntu/linux-aws-5.4<5.4.0-1051.53~18.04.1

5.4.0-1051.53~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1121.134

4.15.0-1121.134

ubuntu/linux-azure-5.4<5.4.0-1051.53~18.04.1

5.4.0-1051.53~18.04.1

ubuntu/linux-gcp-4.15<4.15.0-1106.120

4.15.0-1106.120

ubuntu/linux-gcp-5.4<5.4.0-1046.49~18.04.1

5.4.0-1046.49~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-77.86~18.04.1

5.4.0-77.86~18.04.1

ubuntu/linux-kvm<4.15.0-1097.99

4.15.0-1097.99

ubuntu/linux-oracle<4.15.0-1078.86

4.15.0-1078.86

ubuntu/linux-oracle-5.4<5.4.0-1048.52~18.04.1

5.4.0-1048.52~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1038.41~18.04.1

5.4.0-1038.41~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2051.53

4.15.0-2051.53

ubuntu/linux-azure-fips<4.15.0-2033.37

4.15.0-2033.37

ubuntu/linux-fips<4.15.0-1066.75

4.15.0-1066.75

ubuntu/linux-gcp-fips<4.15.0-2016.18

4.15.0-2016.18

ubuntu/linux<5.4.0-77.86

5.4.0-77.86

ubuntu/linux-aws<5.4.0-1051.53

5.4.0-1051.53

ubuntu/linux-azure<5.4.0-1051.53

5.4.0-1051.53

ubuntu/linux-bluefield<5.4.0-1013.16

5.4.0-1013.16

ubuntu/linux-gcp<5.4.0-1046.49

5.4.0-1046.49

ubuntu/linux-gkeop<5.4.0-1018.19

5.4.0-1018.19

ubuntu/linux-kvm<5.4.0-1041.42

5.4.0-1041.42

ubuntu/linux-oracle<5.4.0-1048.52

5.4.0-1048.52

ubuntu/linux-raspi<5.4.0-1038.41

5.4.0-1038.41

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-fips<5.4.0-1028.32

5.4.0-1028.32

ubuntu/linux-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1121.134~14.04.1
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1143.149
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-268.302~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-268.302
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1181.196
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1109.116~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1121.134~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1106.120~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-151.157~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1144.155
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1078.86~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1113.120
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-151.157
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1109.116
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.53~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1121.134
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.53~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1106.120
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1046.49~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-77.86~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1097.99
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1078.86
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1048.52~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1038.41~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2051.53
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2033.37
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1066.75
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2016.18
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-77.86
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.53
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.53
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1013.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1046.49
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1018.19
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1041.42
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1048.52
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1038.41
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1028.32
Compensating control
Track the devm allocation state as a stable flag on the SPI controller, rather than relying on the devres list during spi_unregister_controller() and devm_spi_release_controller() cleanup.

Event History

Feb 29, 2024

CVE Published

via MITRE·10:31 PM

Data Sourced

via MITRE·10:31 PM

Description

Data Sourced

via OSV·11:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2021-46959?

CVE-2021-46959 has a moderate severity level due to the potential for use-after-free vulnerabilities in the Linux kernel.

How do I fix CVE-2021-46959?