CVE-2021-47385: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

Q: What is the severity of CVE-2021-47385?

CVE-2021-47385 has been classified as a low-severity vulnerability due to its nature of causing a NULL pointer dereference.

Q: How do I fix CVE-2021-47385?

To fix CVE-2021-47385, update the Linux kernel to version 5.4.151, 5.10.71, 5.14.10, or 5.15.

Q: Which Linux kernel versions are affected by CVE-2021-47385?

CVE-2021-47385 affects versions of the Linux kernel prior to 5.4.151, between 5.5 and 5.10.71, between 5.11 and 5.14.10, and the 5.15 series.

Q: What component is impacted by CVE-2021-47385?

CVE-2021-47385 impacts the hwmon subsystem related to the w83792d driver in the Linux kernel.

Q: Can CVE-2021-47385 lead to system crashes?

Yes, CVE-2021-47385 can lead to system instability and crashes due to a NULL pointer dereference.

Published May 21, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

If driver read val value sufficient for (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)) from device then Null pointer dereference occurs. (It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devmi2cnewdummydevice() in w83791ddetectsubclients().

The patch fixes possible NULL pointer dereference by removing lm75[].

Found by Linux Driver Verification project (linuxtesting.org).

[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]

Other sources

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

The Linux kernel CVE team has assigned CVE-2021-47385 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052144-CVE-2021-47385-a7e7@gregkh/T

— Red Hat

Affected Software

101 affected componentsFixes available

Linux Linux kernel<5.4.151

Linux Linux kernel>=5.5<5.10.71

Linux Linux kernel>=5.11<5.14.10

Linux Linux kernel=5.15-rc1

Linux Linux kernel=5.15-rc2

Linux Linux kernel=5.15-rc3

redhat/kernel<5.4.151

5.4.151

redhat/kernel<5.10.71

5.10.71

redhat/kernel<5.14.10

5.14.10

redhat/kernel<5.15

5.15

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.4<5.4.0-1060.63~18.04.1

5.4.0-1060.63~18.04.1

ubuntu/linux-azure-5.4<5.4.0-1064.67~18.04.1

5.4.0-1064.67~18.04.1

ubuntu/linux-gcp-5.4<5.4.0-1058.62~18.04.1

5.4.0-1058.62~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-91.102~18.04.1

5.4.0-91.102~18.04.1

ubuntu/linux-oracle-5.4<5.4.0-1058.62~18.04.1

5.4.0-1058.62~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1047.52~18.04.1

5.4.0-1047.52~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux<5.4.0-91.102

5.4.0-91.102

ubuntu/linux-aws<5.4.0-1060.63

5.4.0-1060.63

ubuntu/linux-azure<5.4.0-1064.67

5.4.0-1064.67

ubuntu/linux-bluefield<5.4.0-1022.25

5.4.0-1022.25

ubuntu/linux-gcp<5.4.0-1058.62

5.4.0-1058.62

ubuntu/linux-gkeop<5.4.0-1027.28

5.4.0-1027.28

ubuntu/linux-ibm<5.4.0-1008.9

5.4.0-1008.9

ubuntu/linux-kvm<5.4.0-1050.52

5.4.0-1050.52

ubuntu/linux-oracle<5.4.0-1058.62

5.4.0-1058.62

ubuntu/linux-raspi<5.4.0-1047.52

5.4.0-1047.52

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1069.73+fips2

5.4.0-1069.73+fips2

ubuntu/linux-azure-fips<5.4.0-1073.76+fips1

5.4.0-1073.76+fips1

ubuntu/linux-fips<5.4.0-1037.43

5.4.0-1037.43

ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1

5.4.0-1067.71~20.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 5.4.151
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 5.10.71
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 5.14.10
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 5.15
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1060.63~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1064.67~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1058.62~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-91.102~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1058.62~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1047.52~18.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-91.102
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1060.63
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1064.67
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1022.25
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1058.62
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1027.28
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1008.9
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1050.52
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1058.62
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1047.52
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73+fips2
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1037.43
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71~20.04.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2021-47385

Event History

May 21, 2024

CVE Published

via MITRE·03:03 PM

Data Sourced

via MITRE·03:03 PM

Description

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

May 22, 2024

Data Sourced

via Red Hat·09:13 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2021-47385?

CVE-2021-47385 has been classified as a low-severity vulnerability due to its nature of causing a NULL pointer dereference.

How do I fix CVE-2021-47385?

To fix CVE-2021-47385, update the Linux kernel to version 5.4.151, 5.10.71, 5.14.10, or 5.15.

Which Linux kernel versions are affected by CVE-2021-47385?

CVE-2021-47385 affects versions of the Linux kernel prior to 5.4.151, between 5.5 and 5.10.71, between 5.11 and 5.14.10, and the 5.15 series.

What component is impacted by CVE-2021-47385?

CVE-2021-47385 impacts the hwmon subsystem related to the w83792d driver in the Linux kernel.

Can CVE-2021-47385 lead to system crashes?

Yes, CVE-2021-47385 can lead to system instability and crashes due to a NULL pointer dereference.

CVE-2021-47385: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2021-47385?

How do I fix CVE-2021-47385?

Which Linux kernel versions are affected by CVE-2021-47385?

What component is impacted by CVE-2021-47385?

Can CVE-2021-47385 lead to system crashes?

Company

Resources

Contact