CVE-2021-47416
Description
In the Linux kernel, the following vulnerability has been resolved: phy: mdio: fix memory leak Syzbot reported memory leak in MDIO bus interface, the problem was in wrong state logic. MDIOBUS_ALLOCATED indicates 2 states: 1. Bus is only allocated 2. Bus allocated and __mdiobus_register() fails, but device_register() was called In case of device_register() has been called we should call put_device() to correctly free the memory allocated for this device, but mdiobus_free() calls just kfree(dev) in case of MDIOBUS_ALLOCATED state To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED _before_ calling device_register(), because put_device() should be called even in case of device_register() failure.
How to fix
- linux linux_kernel4.4.289, 4.9.287, 4.14.251, 4.19.211, 5.4.153, 5.10.73, 5.14.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.28 ≤ v < 4.4.289, 4.5 ≤ v < 4.9.287, 4.10 ≤ v < 4.14.251, 4.15 ≤ v < 4.19.211, 4.20 ≤ v < 5.4.153, 5.5 ≤ v < 5.10.73, 5.11 ≤ v < 5.14.12, 5.15 | 4.4.289, 4.9.287, 4.14.251, 4.19.211, 5.4.153, 5.10.73, 5.14.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.