NetSight
IP …
high7.8

CVE-2021-47239

In the Linux kernel, the following vulnerability has been resolved: net: usb: fix possible use-after-free in smsc75xx_bind The commit 46a8b29c6306 ("net: usb: …

Impact

In the Linux kernel, the following vulnerability has been resolved: net: usb: fix possible use-after-free in smsc75xx_bind The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind") fails to clean up the work scheduled in smsc75xx_reset-> smsc75xx_set_multicast, which leads to use-after-free if the work is scheduled to start after the deallocation. In addition, this patch also removes a dangling pointer - dev->data[0]. This patch calls cancel_work_sync to cancel the scheduled work and set the dangling pointer to NULL.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.4.271 before 4.4.274
from 4.9.271 before 4.9.274
from 4.14.235 before 4.14.238
from 4.19.193 before 4.19.196
from 5.4.124 before 5.4.128
from 5.10.42 before 5.10.46

Weakness classification

CWE-416

References