7.8high

CVE-2021-47653

media: davinci: vpif: fix use-after-free on driver unbind

Published 20 mo ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 19%
Public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

media: davinci: vpif: fix use-after-free on driver unbind

The driver allocates and registers two platform device structures during probe, but the devices were never deregistered on driver unbind.

This results in a use-after-free on driver unbind as the device structures were allocated using devres and would be freed by driver core when remove() returns.

Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors.

Note that the platform device structures must be freed using a proper release callback to avoid leaking associated resources like device names.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

0.27% probability of exploitation in the next 30 days, higher than 19% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds
Linux kernel (RSS, critical only)

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.