UBUNTU-CVE-2021-46959: Use After Free

Q: Which Ubuntu kernel package variants are listed as affected?

The listed packages are ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-fips, ubuntu/linux-gcp, ubuntu/linux-hwe, ubuntu/linux-kvm, and ubuntu/linux-oracle.

Q: What access does an attacker need according to the severity vector?

The vector indicates local access, low attack complexity, low privileges required, and no user interaction. It also rates confidentiality, integrity, and availability impact as high.

Q: What runtime evidence may indicate this issue is being triggered?

The description shows a refcount saturation warning during controller teardown, including calls through devm_spi_release_controller, release_nodes, devres_release_all, and __device_release_driver. It attributes the warning to reference counters being decremented below zero for devices registered with devm_spi_alloc_master() or devm_spi_alloc_slave().

Published Feb 29, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: spi: Fix use-after-free with devmspialloc We can't rely on the contents of the devres list during spiunregistercontroller(), as the list is already torn down at the time we perform devresfind() for devmspireleasecontroller. This causes devices registered with devmspialloc{master,slave}() to be mistakenly identified as legacy, non-devm managed devices and have their reference counters decremented below 0. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcountwarnsaturate+0x108/0x174 [<b0396f04>] (refcountwarnsaturate) from [<b03c56a4>] (kobjectput+0x90/0x98) [<b03c5614>] (kobjectput) from [<b0447b4c>] (putdevice+0x20/0x24) r4:b6700140 [<b0447b2c>] (putdevice) from [<b07515e8>] (devmspireleasecontroller+0x3c/0x40) [<b07515ac>] (devmspireleasecontroller) from [<b045343c>] (releasenodes+0x84/0xc4) r5:b6700180 r4:b6700100 [<b04533b8>] (releasenodes) from [<b0454160>] (devresreleaseall+0x5c/0x60) r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10 [<b0454104>] (devresreleaseall) from [<b044e41c>] (devicereleasedriver+0x144/0x1ec) r5:b117ad94 r4:b163dc10 [<b044e2d8>] (devicereleasedriver) from [<b044f70c>] (devicedriverdetach+0x84/0xa0) r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10 [<b044f688>] (devicedriverdetach) from [<b044d274>] (unbindstore+0xe4/0xf8) Instead, determine the devm allocation state as a flag on the controller which is guaranteed to be stable during cleanup.

Affected Software

105 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1121.134~14.04.1

4.15.0-1121.134~14.04.1

ubuntu/linux-aws<4.4.0-1143.149

4.4.0-1143.149

ubuntu/linux-lts-xenial<4.4.0-268.302~14.04.1

4.4.0-268.302~14.04.1

ubuntu/linux<4.4.0-268.302

4.4.0-268.302

ubuntu/linux-aws<4.4.0-1181.196

4.4.0-1181.196

ubuntu/linux-aws-hwe<4.15.0-1109.116~16.04.1

4.15.0-1109.116~16.04.1

ubuntu/linux-azure<4.15.0-1121.134~16.04.1

4.15.0-1121.134~16.04.1

ubuntu/linux-gcp<4.15.0-1106.120~16.04.1

4.15.0-1106.120~16.04.1

ubuntu/linux-hwe<4.15.0-151.157~16.04.1

4.15.0-151.157~16.04.1

ubuntu/linux-kvm<4.4.0-1144.155

4.4.0-1144.155

ubuntu/linux-oracle<4.15.0-1078.86~16.04.1

4.15.0-1078.86~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1113.120

4.4.0-1113.120

ubuntu/linux<4.15.0-151.157

4.15.0-151.157

ubuntu/linux-aws<4.15.0-1109.116

4.15.0-1109.116

ubuntu/linux-aws-5.4<5.4.0-1051.53~18.04.1

5.4.0-1051.53~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1121.134

4.15.0-1121.134

ubuntu/linux-azure-5.4<5.4.0-1051.53~18.04.1

5.4.0-1051.53~18.04.1

ubuntu/linux-gcp-4.15<4.15.0-1106.120

4.15.0-1106.120

ubuntu/linux-gcp-5.4<5.4.0-1046.49~18.04.1

5.4.0-1046.49~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-77.86~18.04.1

5.4.0-77.86~18.04.1

ubuntu/linux-kvm<4.15.0-1097.99

4.15.0-1097.99

ubuntu/linux-oracle<4.15.0-1078.86

4.15.0-1078.86

ubuntu/linux-oracle-5.4<5.4.0-1048.52~18.04.1

5.4.0-1048.52~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1038.41~18.04.1

5.4.0-1038.41~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2051.53

4.15.0-2051.53

ubuntu/linux-azure-fips<4.15.0-2033.37

4.15.0-2033.37

ubuntu/linux-fips<4.15.0-1066.75

4.15.0-1066.75

ubuntu/linux-gcp-fips<4.15.0-2016.18

4.15.0-2016.18

ubuntu/linux<5.4.0-77.86

5.4.0-77.86

ubuntu/linux-aws<5.4.0-1051.53

5.4.0-1051.53

ubuntu/linux-azure<5.4.0-1051.53

5.4.0-1051.53

ubuntu/linux-bluefield<5.4.0-1013.16

5.4.0-1013.16

ubuntu/linux-gcp<5.4.0-1046.49

5.4.0-1046.49

ubuntu/linux-gkeop<5.4.0-1018.19

5.4.0-1018.19

ubuntu/linux-kvm<5.4.0-1041.42

5.4.0-1041.42

ubuntu/linux-oracle<5.4.0-1048.52

5.4.0-1048.52

ubuntu/linux-raspi<5.4.0-1038.41

5.4.0-1038.41

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-fips<5.4.0-1028.32

5.4.0-1028.32

ubuntu/linux-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1121.134~14.04.1
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1143.149
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-268.302~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-268.302
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1181.196
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1109.116~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1121.134~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1106.120~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-151.157~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1144.155
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1078.86~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1113.120
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-151.157
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1109.116
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.53~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1121.134
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.53~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1106.120
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1046.49~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-77.86~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1097.99
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1078.86
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1048.52~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1038.41~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2051.53
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2033.37
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1066.75
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2016.18
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-77.86
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.53
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.53
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1013.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1046.49
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1018.19
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1041.42
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1048.52
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1038.41
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1028.32

Event History

Feb 29, 2024

CVE Published

via OSV·11:15 PM

Data Sourced

via OSV·11:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel package variants are listed as affected?

The listed packages are ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-fips, ubuntu/linux-gcp, ubuntu/linux-hwe, ubuntu/linux-kvm, and ubuntu/linux-oracle.

What access does an attacker need according to the severity vector?

The vector indicates local access, low attack complexity, low privileges required, and no user interaction. It also rates confidentiality, integrity, and availability impact as high.

What runtime evidence may indicate this issue is being triggered?

The description shows a refcount saturation warning during controller teardown, including calls through devm_spi_release_controller, release_nodes, devres_release_all, and __device_release_driver. It attributes the warning to reference counters being decremented below zero for devices registered with devm_spi_alloc_master() or devm_spi_alloc_slave().

UBUNTU-CVE-2021-46959: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel package variants are listed as affected?

What access does an attacker need according to the severity vector?

What runtime evidence may indicate this issue is being triggered?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel package variants are listed as affected?

What access does an attacker need according to the severity vector?

What runtime evidence may indicate this issue is being triggered?