NetSight
IP …
medium5.5

CVE-2021-47416

In the Linux kernel, the following vulnerability has been resolved: phy: mdio: fix memory leak Syzbot reported memory leak in MDIO bus interface, the problem w…

Impact

In the Linux kernel, the following vulnerability has been resolved: phy: mdio: fix memory leak Syzbot reported memory leak in MDIO bus interface, the problem was in wrong state logic. MDIOBUS_ALLOCATED indicates 2 states: 1. Bus is only allocated 2. Bus allocated and __mdiobus_register() fails, but device_register() was called In case of device_register() has been called we should call put_device() to correctly free the memory allocated for this device, but mdiobus_free() calls just kfree(dev) in case of MDIOBUS_ALLOCATED state To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED _before_ calling device_register(), because put_device() should be called even in case of device_register() failure.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.28 before 4.4.289
from 4.5 before 4.9.287
from 4.10 before 4.14.251
from 4.15 before 4.19.211
from 4.20 before 5.4.153
from 5.5 before 5.10.73

Weakness classification

CWE-401

References