Log in Start free

Vulnerability · Published Apr 10, 2024 · Assigned by Linux

CVE-2021-47195spi: fix use-after-free of the add_lock mutex

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 87.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free of the add_lock mutex Commit 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on SPI buses") introduced a per-controller mutex. But mutex_unlock() of said lock is called after the controller is already freed: spi_unregister_controller(ctlr) -> put_device(&ctlr->dev) -> spi_controller_release(dev) -> mutex_unlock(&ctrl->add_lock) Move the put_device() after the mutex_unlock().

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.15.5-1DEBIAN-CVE-2021-47195
Debian:13linux5.15.5-1DEBIAN-CVE-2021-47195
Debian:14linux5.15.5-1DEBIAN-CVE-2021-47195
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47195
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47195
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47195
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47195

Affected products (as reported)

VendorProductVersions
Linux Linux aa3f3d7bef59583f2d3234173105a27ff61ef8fe – before 54c2c96eafcfd242e52e932ab54ace4784efe1ddc8dce228db6f81dbc897a018dfc5c418e917cf64 – before 11eab327a2a8bd36c38afbff920ae1bd45588dd46098475d4cb48d821bdf453c61118c56e26294f0 – before 37330f37f6666c7739a44b2b6b95b047ccdbed2d6098475d4cb48d821bdf453c61118c56e26294f0 – before 6c53b45c71b4920b5e62f0ea8079a1da382b9434722ef19a161ce3fffb3d1b01ce2301c306639bdd5.14.15 – before 5.15
Linux Linux 5.15

References