Log in Start free

Vulnerability · Published May 24, 2024 · Assigned by Linux

CVE-2021-47500iio: mma8452: Fix trigger reference couting

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 84.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: iio: mma8452: Fix trigger reference couting The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.15.15-1DEBIAN-CVE-2021-47500
Debian:13linux5.15.15-1DEBIAN-CVE-2021-47500
Debian:14linux5.15.15-1DEBIAN-CVE-2021-47500
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47500
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47500
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47500

Affected products (as reported)

VendorProductVersions
Linux Linux ae6d9ce05691bf79694074db7c7da980080548af – before 094d513b78b1714113bc016684b8142382e071baae6d9ce05691bf79694074db7c7da980080548af – before fb75cc4740d81264cd5bcb0e17d961d018a8be96ae6d9ce05691bf79694074db7c7da980080548af – before 794c0898f6bf39a458655d5fb4af70ec43a5cfcbae6d9ce05691bf79694074db7c7da980080548af – before f5deab10ced368c807866283f8b79144c4823be8ae6d9ce05691bf79694074db7c7da980080548af – before acf0088ac073ca6e7f4cad6acac112177e08df5eae6d9ce05691bf79694074db7c7da980080548af – before db12d95085367de8b0223929d1332731024441f1ae6d9ce05691bf79694074db7c7da980080548af – before c43517071dfc9fce34f8f69dbb98a86017f6b739ae6d9ce05691bf79694074db7c7da980080548af – before cd0082235783f814241a1c9483fb89e405f4f892
Linux Linux 4.2

References