CVE-2021-47361
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-47361
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47361.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-47361
- Downstream
- Related
- Published
- 2024-05-21T15:15:22Z
- Modified
- 2025-08-09T20:01:25Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
mcb: fix error handling in mcballocbus()
There are two bugs: 1) If idasimpleget() fails then this code calls putdevice(carrier) but we haven't yet called getdevice(carrier) and probably that leads to a use after free. 2) After deviceinitialize() then we need to use putdevice() to release the bus. This will free the internal resources tied to the device and call mcbfreebus() which will free the rest.
- References
-
- https://git.kernel.org/stable/c/115b07d9f47e3996430b8f2007edd9768e1f807f
- https://git.kernel.org/stable/c/25a1433216489de4abc889910f744e952cb6dbae
- https://git.kernel.org/stable/c/66f74ba9be9daf9c47fface6af3677f602774f6b
- https://git.kernel.org/stable/c/7751f609eadf36b1f53712bae430019c53a16eb0
- https://git.kernel.org/stable/c/8a558261fa57a6deefb0925ab1829f698b194aea
- https://git.kernel.org/stable/c/91e4ad05bf18322b5921d1a6c9b603f6eb1694f0
- https://git.kernel.org/stable/c/9fc198f415dee070a1de957bb5bf5921d8df3499