In the Linux kernel, the following vulnerability has been resolved: net: usb: fix possible use-after-free in smsc75xx_bind The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind") fails to clean up the work scheduled in smsc75xx_reset-> smsc75xx_set_multicast, which leads to use-after-free if the work is scheduled to start after the deallocation. In addition, this patch also removes a dangling pointer - dev->data[0]. This patch calls cancel_work_sync to cancel the scheduled work and set the dangling pointer to NULL.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/14616c372a7be01a2fb8c56c9d8debd232b9e43d cve-icon cve-icon
https://git.kernel.org/stable/c/2fc8300c9cfa5167fcb5b1a2a07db6f53e82f59b cve-icon cve-icon
https://git.kernel.org/stable/c/4252bf6c2b245f47011098113d405ffad6ad5d5b cve-icon cve-icon
https://git.kernel.org/stable/c/56b786d86694e079d8aad9b314e015cd4ac02a3d cve-icon cve-icon
https://git.kernel.org/stable/c/570a52cf3e01d19f7fd1a251dfc52b0cd86c13cb cve-icon cve-icon
https://git.kernel.org/stable/c/64160d1741a3de5204d1a822e058e0b4cc526504 cve-icon cve-icon
https://git.kernel.org/stable/c/7cc8b2e05fcea6edd022d26e82091d781af8fd9b cve-icon cve-icon
https://git.kernel.org/stable/c/c4e3be2e7742863e454ce31faf8fd0109c00050b cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024052141-CVE-2021-47239-ae00@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47239 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47239 cve-icon
History

Mon, 30 Dec 2024 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 04 Nov 2024 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T14:19:39.705Z

Updated: 2025-05-04T07:06:56.591Z

Reserved: 2024-04-10T18:59:19.532Z

Link: CVE-2021-47239

cve-icon Vulnrichment

Updated: 2024-08-04T05:32:07.920Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-21T15:15:13.100

Modified: 2024-12-30T19:05:15.167

Link: CVE-2021-47239

cve-icon Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2021-47239 - Bugzilla