NetSight
IP …
high7.8

CVE-2021-47500

In the Linux kernel, the following vulnerability has been resolved: iio: mma8452: Fix trigger reference couting The mma8452 driver directly assigns a trigger t…

Impact

In the Linux kernel, the following vulnerability has been resolved: iio: mma8452: Fix trigger reference couting The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.2 before 4.4.295
from 4.5 before 4.9.293
from 4.10 before 4.14.258
from 4.15 before 4.19.221
from 4.20 before 5.4.165
from 5.5 before 5.10.85

Weakness classification

CWE-416

References