Log in Start free

Vulnerability · Published Mar 25, 2024 · Assigned by Linux

CVE-2021-47180NFC: nci: fix memory leak in nci_allocate_device

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 86.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: fix memory leak in nci_allocate_device nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev. Fix this by freeing hci_dev in nci_free_device. BUG: memory leak unreferenced object 0xffff888111ea6800 (size 1024): comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline] [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline] [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784 [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline] [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132 [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153 [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345 [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846 [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914 [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109 [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164 [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.14.6-1DEBIAN-CVE-2021-47180
Debian:13linux5.14.6-1DEBIAN-CVE-2021-47180
Debian:14linux5.14.6-1DEBIAN-CVE-2021-47180
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47180
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47180
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47180

Affected products (as reported)

VendorProductVersions
Linux Linux 11f54f228643d0248ec00ce8c9fb8d872f87e7b8 – before 448a1cb12977f52142e6feb12022c59662d88dc111f54f228643d0248ec00ce8c9fb8d872f87e7b8 – before 4a621621c7af3cec21c47c349b30cd9c3cea11c811f54f228643d0248ec00ce8c9fb8d872f87e7b8 – before 2c2fb2df46ea866b49fea5ec7112ec3cd4896c7411f54f228643d0248ec00ce8c9fb8d872f87e7b8 – before 0365701bc44e078682ee1224866a71897495c7ef11f54f228643d0248ec00ce8c9fb8d872f87e7b8 – before af2a4426baf71163c0c354580ae98c7888a9aba711f54f228643d0248ec00ce8c9fb8d872f87e7b8 – before b34cb7ac32cc8e5471dc773180ea9ae676b1a74511f54f228643d0248ec00ce8c9fb8d872f87e7b8 – before 65234f50a90b64b335cbb9164b8a98c2a0d031dd11f54f228643d0248ec00ce8c9fb8d872f87e7b8 – before e0652f8bb44d6294eeeac06d703185357f25d50b
Linux Linux 4.0

References