CVE-2021-47589 - Vulnerability Details

Vendors	Products
Linux	Linux Kernel

Link	Providers
https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411
https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49
https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a
https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc
https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54
https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028
https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac
https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb
https://lore.kernel.org/linux-cve-announce/2024061918-CVE-2021-47589-d405@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47589
https://www.cve.org/CVERecord?id=CVE-2021-47589

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47589", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-24T15:11:00.732Z", "datePublished": "2024-06-19T14:53:53.565Z", "dateUpdated": "2025-05-04T07:14:15.834Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T07:14:15.834Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigbvf: fix double free in `igbvf_probe`\n\nIn `igbvf_probe`, if register_netdev() fails, the program will go to\nlabel err_hw_init, and then to label err_ioremap. In free_netdev() which\nis just below label err_ioremap, there is `list_for_each_entry_safe` and\n`netif_napi_del` which aims to delete all entries in `dev->napi_list`.\nThe program has added an entry `adapter->rx_ring->napi` which is added by\n`netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has\nbeen freed below label err_hw_init. So this a UAF.\n\nIn terms of how to patch the problem, we can refer to igbvf_remove() and\ndelete the entry before `adapter->rx_ring`.\n\nThe KASAN logs are as follows:\n\n[   35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450\n[   35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366\n[   35.128360]\n[   35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14\n[   35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[   35.131749] Call Trace:\n[   35.132199]  dump_stack_lvl+0x59/0x7b\n[   35.132865]  print_address_description+0x7c/0x3b0\n[   35.133707]  ? free_netdev+0x1fd/0x450\n[   35.134378]  __kasan_report+0x160/0x1c0\n[   35.135063]  ? free_netdev+0x1fd/0x450\n[   35.135738]  kasan_report+0x4b/0x70\n[   35.136367]  free_netdev+0x1fd/0x450\n[   35.137006]  igbvf_probe+0x121d/0x1a10 [igbvf]\n[   35.137808]  ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf]\n[   35.138751]  local_pci_probe+0x13c/0x1f0\n[   35.139461]  pci_device_probe+0x37e/0x6c0\n[   35.165526]\n[   35.165806] Allocated by task 366:\n[   35.166414]  ____kasan_kmalloc+0xc4/0xf0\n[   35.167117]  foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf]\n[   35.168078]  igbvf_probe+0x9c5/0x1a10 [igbvf]\n[   35.168866]  local_pci_probe+0x13c/0x1f0\n[   35.169565]  pci_device_probe+0x37e/0x6c0\n[   35.179713]\n[   35.179993] Freed by task 366:\n[   35.180539]  kasan_set_track+0x4c/0x80\n[   35.181211]  kasan_set_free_info+0x1f/0x40\n[   35.181942]  ____kasan_slab_free+0x103/0x140\n[   35.182703]  kfree+0xe3/0x250\n[   35.183239]  igbvf_probe+0x1173/0x1a10 [igbvf]\n[   35.184040]  local_pci_probe+0x13c/0x1f0"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/igbvf/netdev.c"], "versions": [{"version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "ffe1695b678729edec04037e691007900a2b2beb", "status": "affected", "versionType": "git"}, {"version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "79d9b092035dcdbe636b70433149df9cc6db1e49", "status": "affected", "versionType": "git"}, {"version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "8d0c927a9fb2b4065230936b77b54f857a3754fc", "status": "affected", "versionType": "git"}, {"version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "cc9b655bb84f1be283293dfea94dff9a31b106ac", "status": "affected", "versionType": "git"}, {"version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "8addba6cab94ce01686ea2e80ed1530f9dc33a9a", "status": "affected", "versionType": "git"}, {"version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "74a16e062b23332d8db017ff4a41e16279c44411", "status": "affected", "versionType": "git"}, {"version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "944b8be08131f5faf2cd2440aa1c24a39a163a54", "status": "affected", "versionType": "git"}, {"version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "b6d335a60dc624c0d279333b22c737faa765b028", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/igbvf/netdev.c"], "versions": [{"version": "2.6.30", "status": "affected"}, {"version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver"}, {"version": "4.4.296", "lessThanOrEqual": "4.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.294", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.259", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.222", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.168", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.88", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.11", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.4.296"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.9.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.14.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.19.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.4.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb"}, {"url": "https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49"}, {"url": "https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc"}, {"url": "https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac"}, {"url": "https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a"}, {"url": "https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411"}, {"url": "https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54"}, {"url": "https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028"}], "title": "igbvf: fix double free in `igbvf_probe`", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-20T17:58:29.700241Z", "id": "CVE-2021-47589", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T17:58:40.103Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.864Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2021-47589 (string)

assignerOrgId : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

state : PUBLISHED (string)

assignerShortName : Linux (string)

dateReserved : 2024-05-24T15:11:00.732Z (string)

datePublished : 2024-06-19T14:53:53.565Z (string)

dateUpdated : 2025-05-04T07:14:15.834Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

shortName : Linux (string)

dateUpdated : 2025-05-04T07:14:15.834Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF. In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`. The KASAN logs are as follows: [ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0 (string)

}

]

affected : [ »

0 : { »

product : Linux (string)

vendor : Linux (string)

defaultStatus : unaffected (string)

repo : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (string)

programFiles : [ »

0 : drivers/net/ethernet/intel/igbvf/netdev.c (string)

]

versions : [ »

0 : { »

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : ffe1695b678729edec04037e691007900a2b2beb (string)

status : affected (string)

versionType : git (string)

}

1 : { »

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 79d9b092035dcdbe636b70433149df9cc6db1e49 (string)

status : affected (string)

versionType : git (string)

}

2 : { »

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 8d0c927a9fb2b4065230936b77b54f857a3754fc (string)

status : affected (string)

versionType : git (string)

}

3 : { »

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : cc9b655bb84f1be283293dfea94dff9a31b106ac (string)

status : affected (string)

versionType : git (string)

}

4 : { »

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 8addba6cab94ce01686ea2e80ed1530f9dc33a9a (string)

status : affected (string)

versionType : git (string)

}

5 : { »

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 74a16e062b23332d8db017ff4a41e16279c44411 (string)

status : affected (string)

versionType : git (string)

}

6 : { »

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 944b8be08131f5faf2cd2440aa1c24a39a163a54 (string)

status : affected (string)

versionType : git (string)

}

7 : { »

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : b6d335a60dc624c0d279333b22c737faa765b028 (string)

status : affected (string)

versionType : git (string)

}

]

}

1 : { »

product : Linux (string)

vendor : Linux (string)

defaultStatus : affected (string)

repo : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (string)

programFiles : [ »

0 : drivers/net/ethernet/intel/igbvf/netdev.c (string)

]

versions : [ »

0 : { »

version : 2.6.30 (string)

status : affected (string)

}

1 : { »

version : 0 (string)

lessThan : 2.6.30 (string)

status : unaffected (string)

versionType : semver (string)

}

2 : { »

version : 4.4.296 (string)

lessThanOrEqual : 4.4.* (string)

status : unaffected (string)

versionType : semver (string)

}

3 : { »

version : 4.9.294 (string)

lessThanOrEqual : 4.9.* (string)

status : unaffected (string)

versionType : semver (string)

}

4 : { »

version : 4.14.259 (string)

lessThanOrEqual : 4.14.* (string)

status : unaffected (string)

versionType : semver (string)

}

5 : { »

version : 4.19.222 (string)

lessThanOrEqual : 4.19.* (string)

status : unaffected (string)

versionType : semver (string)

}

6 : { »

version : 5.4.168 (string)

lessThanOrEqual : 5.4.* (string)

status : unaffected (string)

versionType : semver (string)

}

7 : { »

version : 5.10.88 (string)

lessThanOrEqual : 5.10.* (string)

status : unaffected (string)

versionType : semver (string)

}

8 : { »

version : 5.15.11 (string)

lessThanOrEqual : 5.15.* (string)

status : unaffected (string)

versionType : semver (string)

}

9 : { »

version : 5.16 (string)

lessThanOrEqual : * (string)

status : unaffected (string)

versionType : original_commit_for_fix (string)

}

]

}

]

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

operator : OR (string)

negate : false (boolean)

cpeMatch : [ »

0 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.6.30 (string)

versionEndExcluding : 4.4.296 (string)

}

1 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.6.30 (string)

versionEndExcluding : 4.9.294 (string)

}

2 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.6.30 (string)

versionEndExcluding : 4.14.259 (string)

}

3 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.6.30 (string)

versionEndExcluding : 4.19.222 (string)

}

4 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.6.30 (string)

versionEndExcluding : 5.4.168 (string)

}

5 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.6.30 (string)

versionEndExcluding : 5.10.88 (string)

}

6 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.6.30 (string)

versionEndExcluding : 5.15.11 (string)

}

7 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.6.30 (string)

versionEndExcluding : 5.16 (string)

}

]

}

]

}

]

references : [ »

0 : { »

url : https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb (string)

}

1 : { »

url : https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49 (string)

}

2 : { »

url : https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc (string)

}

3 : { »

url : https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac (string)

}

4 : { »

url : https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a (string)

}

5 : { »

url : https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411 (string)

}

6 : { »

url : https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54 (string)

}

7 : { »

url : https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028 (string)

}

]

title : igbvf: fix double free in `igbvf_probe` (string)

x_generator : { »

engine : bippy-1.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-06-20T17:58:29.700241Z (string)

id : CVE-2021-47589 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-06-20T17:58:40.103Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T05:39:59.864Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49 (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac (string)

tags : [ »

0 : x_transferred (string)

]

}

4 : { »

url : https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a (string)

tags : [ »

0 : x_transferred (string)

]

}

5 : { »

url : https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411 (string)

tags : [ »

0 : x_transferred (string)

]

}

6 : { »

url : https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54 (string)

tags : [ »

0 : x_transferred (string)

]

}

7 : { »

url : https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.864Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47589", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-20T17:58:29.700241Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T17:58:36.108Z"}}], "cna": {"title": "igbvf: fix double free in `igbvf_probe`", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "ffe1695b678729edec04037e691007900a2b2beb", "versionType": "git"}, {"status": "affected", "version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "79d9b092035dcdbe636b70433149df9cc6db1e49", "versionType": "git"}, {"status": "affected", "version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "8d0c927a9fb2b4065230936b77b54f857a3754fc", "versionType": "git"}, {"status": "affected", "version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "cc9b655bb84f1be283293dfea94dff9a31b106ac", "versionType": "git"}, {"status": "affected", "version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "8addba6cab94ce01686ea2e80ed1530f9dc33a9a", "versionType": "git"}, {"status": "affected", "version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "74a16e062b23332d8db017ff4a41e16279c44411", "versionType": "git"}, {"status": "affected", "version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "944b8be08131f5faf2cd2440aa1c24a39a163a54", "versionType": "git"}, {"status": "affected", "version": "d4e0fe01a38a073568aee541a0247fe734095979", "lessThan": "b6d335a60dc624c0d279333b22c737faa765b028", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/igbvf/netdev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.30", "versionType": "semver"}, {"status": "unaffected", "version": "4.4.296", "versionType": "semver", "lessThanOrEqual": "4.4.*"}, {"status": "unaffected", "version": "4.9.294", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.259", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.222", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.168", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.88", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.11", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/igbvf/netdev.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb"}, {"url": "https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49"}, {"url": "https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc"}, {"url": "https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac"}, {"url": "https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a"}, {"url": "https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411"}, {"url": "https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54"}, {"url": "https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigbvf: fix double free in `igbvf_probe`\n\nIn `igbvf_probe`, if register_netdev() fails, the program will go to\nlabel err_hw_init, and then to label err_ioremap. In free_netdev() which\nis just below label err_ioremap, there is `list_for_each_entry_safe` and\n`netif_napi_del` which aims to delete all entries in `dev->napi_list`.\nThe program has added an entry `adapter->rx_ring->napi` which is added by\n`netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has\nbeen freed below label err_hw_init. So this a UAF.\n\nIn terms of how to patch the problem, we can refer to igbvf_remove() and\ndelete the entry before `adapter->rx_ring`.\n\nThe KASAN logs are as follows:\n\n[   35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450\n[   35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366\n[   35.128360]\n[   35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14\n[   35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[   35.131749] Call Trace:\n[   35.132199]  dump_stack_lvl+0x59/0x7b\n[   35.132865]  print_address_description+0x7c/0x3b0\n[   35.133707]  ? free_netdev+0x1fd/0x450\n[   35.134378]  __kasan_report+0x160/0x1c0\n[   35.135063]  ? free_netdev+0x1fd/0x450\n[   35.135738]  kasan_report+0x4b/0x70\n[   35.136367]  free_netdev+0x1fd/0x450\n[   35.137006]  igbvf_probe+0x121d/0x1a10 [igbvf]\n[   35.137808]  ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf]\n[   35.138751]  local_pci_probe+0x13c/0x1f0\n[   35.139461]  pci_device_probe+0x37e/0x6c0\n[   35.165526]\n[   35.165806] Allocated by task 366:\n[   35.166414]  ____kasan_kmalloc+0xc4/0xf0\n[   35.167117]  foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf]\n[   35.168078]  igbvf_probe+0x9c5/0x1a10 [igbvf]\n[   35.168866]  local_pci_probe+0x13c/0x1f0\n[   35.169565]  pci_device_probe+0x37e/0x6c0\n[   35.179713]\n[   35.179993] Freed by task 366:\n[   35.180539]  kasan_set_track+0x4c/0x80\n[   35.181211]  kasan_set_free_info+0x1f/0x40\n[   35.181942]  ____kasan_slab_free+0x103/0x140\n[   35.182703]  kfree+0xe3/0x250\n[   35.183239]  igbvf_probe+0x1173/0x1a10 [igbvf]\n[   35.184040]  local_pci_probe+0x13c/0x1f0"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.4.296", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.294", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.259", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.222", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.168", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.88", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.11", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16", "versionStartIncluding": "2.6.30"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T07:14:15.834Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47589", "state": "PUBLISHED", "dateUpdated": "2025-05-04T07:14:15.834Z", "dateReserved": "2024-05-24T15:11:00.732Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-19T14:53:53.565Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49 (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac (string)

tags : [ »

0 : x_transferred (string)

]

}

4 : { »

url : https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a (string)

tags : [ »

0 : x_transferred (string)

]

}

5 : { »

url : https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411 (string)

tags : [ »

0 : x_transferred (string)

]

}

6 : { »

url : https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54 (string)

tags : [ »

0 : x_transferred (string)

]

}

7 : { »

url : https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T05:39:59.864Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2021-47589 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-06-20T17:58:29.700241Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-06-20T17:58:36.108Z (string)

}

]

cna : { »

title : igbvf: fix double free in `igbvf_probe` (string)

affected : [ »

0 : { »

repo : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (string)

vendor : Linux (string)

product : Linux (string)

versions : [ »

0 : { »

status : affected (string)

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : ffe1695b678729edec04037e691007900a2b2beb (string)

versionType : git (string)

}

1 : { »

status : affected (string)

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 79d9b092035dcdbe636b70433149df9cc6db1e49 (string)

versionType : git (string)

}

2 : { »

status : affected (string)

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 8d0c927a9fb2b4065230936b77b54f857a3754fc (string)

versionType : git (string)

}

3 : { »

status : affected (string)

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : cc9b655bb84f1be283293dfea94dff9a31b106ac (string)

versionType : git (string)

}

4 : { »

status : affected (string)

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 8addba6cab94ce01686ea2e80ed1530f9dc33a9a (string)

versionType : git (string)

}

5 : { »

status : affected (string)

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 74a16e062b23332d8db017ff4a41e16279c44411 (string)

versionType : git (string)

}

6 : { »

status : affected (string)

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : 944b8be08131f5faf2cd2440aa1c24a39a163a54 (string)

versionType : git (string)

}

7 : { »

status : affected (string)

version : d4e0fe01a38a073568aee541a0247fe734095979 (string)

lessThan : b6d335a60dc624c0d279333b22c737faa765b028 (string)

versionType : git (string)

}

]

programFiles : [ »

0 : drivers/net/ethernet/intel/igbvf/netdev.c (string)

]

defaultStatus : unaffected (string)

}

1 : { »

repo : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (string)

vendor : Linux (string)

product : Linux (string)

versions : [ »

0 : { »

status : affected (string)

version : 2.6.30 (string)

}

1 : { »

status : unaffected (string)

version : 0 (string)

lessThan : 2.6.30 (string)

versionType : semver (string)

}

2 : { »

status : unaffected (string)

version : 4.4.296 (string)

versionType : semver (string)

lessThanOrEqual : 4.4.* (string)

}

3 : { »

status : unaffected (string)

version : 4.9.294 (string)

versionType : semver (string)

lessThanOrEqual : 4.9.* (string)

}

4 : { »

status : unaffected (string)

version : 4.14.259 (string)

versionType : semver (string)

lessThanOrEqual : 4.14.* (string)

}

5 : { »

status : unaffected (string)

version : 4.19.222 (string)

versionType : semver (string)

lessThanOrEqual : 4.19.* (string)

}

6 : { »

status : unaffected (string)

version : 5.4.168 (string)

versionType : semver (string)

lessThanOrEqual : 5.4.* (string)

}

7 : { »

status : unaffected (string)

version : 5.10.88 (string)

versionType : semver (string)

lessThanOrEqual : 5.10.* (string)

}

8 : { »

status : unaffected (string)

version : 5.15.11 (string)

versionType : semver (string)

lessThanOrEqual : 5.15.* (string)

}

9 : { »

status : unaffected (string)

version : 5.16 (string)

versionType : original_commit_for_fix (string)

lessThanOrEqual : * (string)

}

]

programFiles : [ »

0 : drivers/net/ethernet/intel/igbvf/netdev.c (string)

]

defaultStatus : affected (string)

}

]

references : [ »

0 : { »

url : https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb (string)

}

1 : { »

url : https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49 (string)

}

2 : { »

url : https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc (string)

}

3 : { »

url : https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac (string)

}

4 : { »

url : https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a (string)

}

5 : { »

url : https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411 (string)

}

6 : { »

url : https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54 (string)

}

7 : { »

url : https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028 (string)

}

]

x_generator : { »

engine : bippy-1.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF. In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`. The KASAN logs are as follows: [ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0 (string)

}

]

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

negate : false (boolean)

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 4.4.296 (string)

versionStartIncluding : 2.6.30 (string)

}

1 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 4.9.294 (string)

versionStartIncluding : 2.6.30 (string)

}

2 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 4.14.259 (string)

versionStartIncluding : 2.6.30 (string)

}

3 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 4.19.222 (string)

versionStartIncluding : 2.6.30 (string)

}

4 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 5.4.168 (string)

versionStartIncluding : 2.6.30 (string)

}

5 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 5.10.88 (string)

versionStartIncluding : 2.6.30 (string)

}

6 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 5.15.11 (string)

versionStartIncluding : 2.6.30 (string)

}

7 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 5.16 (string)

versionStartIncluding : 2.6.30 (string)

}

]

operator : OR (string)

}

]

}

]

providerMetadata : { »

orgId : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

shortName : Linux (string)

dateUpdated : 2025-05-04T07:14:15.834Z (string)

}

cveMetadata : { »

cveId : CVE-2021-47589 (string)

state : PUBLISHED (string)

dateUpdated : 2025-05-04T07:14:15.834Z (string)

dateReserved : 2024-05-24T15:11:00.732Z (string)

assignerOrgId : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

datePublished : 2024-06-19T14:53:53.565Z (string)

assignerShortName : Linux (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BCDBDCBF-3E2B-4AF7-952D-EB56D077EBF5", "versionEndExcluding": "4.4.296", "versionStartIncluding": "2.6.30", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEC14782-2EE3-4635-A927-91559E4F451C", "versionEndExcluding": "4.9.294", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "390D64FF-1DB7-4DD1-ADEF-CE96BEA2607C", "versionEndExcluding": "4.14.259", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D0D89BC-6CF8-4BFB-8C91-472348052528", "versionEndExcluding": "4.19.222", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "195EBAA1-4CCE-4898-9351-F4A0DBCAA022", "versionEndExcluding": "5.4.168", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A657B2D0-5B9D-42BE-A3BF-228DBC1B057C", "versionEndExcluding": "5.10.88", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "11274E95-438A-449A-B100-01B2B0046669", "versionEndExcluding": "5.15.11", "versionStartIncluding": "5.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigbvf: fix double free in `igbvf_probe`\n\nIn `igbvf_probe`, if register_netdev() fails, the program will go to\nlabel err_hw_init, and then to label err_ioremap. In free_netdev() which\nis just below label err_ioremap, there is `list_for_each_entry_safe` and\n`netif_napi_del` which aims to delete all entries in `dev->napi_list`.\nThe program has added an entry `adapter->rx_ring->napi` which is added by\n`netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has\nbeen freed below label err_hw_init. So this a UAF.\n\nIn terms of how to patch the problem, we can refer to igbvf_remove() and\ndelete the entry before `adapter->rx_ring`.\n\nThe KASAN logs are as follows:\n\n[   35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450\n[   35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366\n[   35.128360]\n[   35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14\n[   35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[   35.131749] Call Trace:\n[   35.132199]  dump_stack_lvl+0x59/0x7b\n[   35.132865]  print_address_description+0x7c/0x3b0\n[   35.133707]  ? free_netdev+0x1fd/0x450\n[   35.134378]  __kasan_report+0x160/0x1c0\n[   35.135063]  ? free_netdev+0x1fd/0x450\n[   35.135738]  kasan_report+0x4b/0x70\n[   35.136367]  free_netdev+0x1fd/0x450\n[   35.137006]  igbvf_probe+0x121d/0x1a10 [igbvf]\n[   35.137808]  ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf]\n[   35.138751]  local_pci_probe+0x13c/0x1f0\n[   35.139461]  pci_device_probe+0x37e/0x6c0\n[   35.165526]\n[   35.165806] Allocated by task 366:\n[   35.166414]  ____kasan_kmalloc+0xc4/0xf0\n[   35.167117]  foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf]\n[   35.168078]  igbvf_probe+0x9c5/0x1a10 [igbvf]\n[   35.168866]  local_pci_probe+0x13c/0x1f0\n[   35.169565]  pci_device_probe+0x37e/0x6c0\n[   35.179713]\n[   35.179993] Freed by task 366:\n[   35.180539]  kasan_set_track+0x4c/0x80\n[   35.181211]  kasan_set_free_info+0x1f/0x40\n[   35.181942]  ____kasan_slab_free+0x103/0x140\n[   35.182703]  kfree+0xe3/0x250\n[   35.183239]  igbvf_probe+0x1173/0x1a10 [igbvf]\n[   35.184040]  local_pci_probe+0x13c/0x1f0"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: igbvf: corrige double free en `igbvf_probe` En `igbvf_probe`, si Register_netdev() falla, el programa ir\u00e1 a la etiqueta err_hw_init y luego a la etiqueta err_ioremap. En free_netdev(), que est\u00e1 justo debajo de la etiqueta err_ioremap, est\u00e1n `list_for_each_entry_safe` y `netif_napi_del` que tienen como objetivo eliminar todas las entradas en `dev-&gt;napi_list`. El programa ha agregado una entrada `adapter-&gt;rx_ring-&gt;napi` que se agrega mediante `netif_napi_add` en igbvf_alloc_queues(). Sin embargo, adaptador-&gt;rx_ring se ha liberado debajo de la etiqueta err_hw_init. Entonces esto es una UAF. En t\u00e9rminos de c\u00f3mo solucionar el problema, podemos consultar igbvf_remove() y eliminar la entrada antes de `adapter-&gt;rx_ring`. Los registros de KASAN son los siguientes: [35.126075] ERROR: KASAN: use-after-free en free_netdev+0x1fd/0x450 [35.127170] Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff88810126d990 mediante la tarea modprobe/366 [35.128360] [35.128643] CPU: 1 PID : 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01 /2014 [35.131749] Seguimiento de llamadas: [35.132199] dump_stack_lvl+0x59/0x7b [35.132865] print_address_description+0x7c/0x3b0 [35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808 ] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] por tarea 366: [35.166414] ____kasan_kmalloc+0xc4/0xf0 [35.167117] foo_kmem_cache_alloc_trace+0x3c/ 0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713 ] [35.179993] Liberado por la tarea 366: [35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 vf] [35.184040] local_pci_probe+0x13c/0x1f0"}], "id": "CVE-2021-47589", "lastModified": "2024-11-21T06:36:36.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-19T15:15:53.490", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : BCDBDCBF-3E2B-4AF7-952D-EB56D077EBF5 (string)

versionEndExcluding : 4.4.296 (string)

versionStartIncluding : 2.6.30 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : BEC14782-2EE3-4635-A927-91559E4F451C (string)

versionEndExcluding : 4.9.294 (string)

versionStartIncluding : 4.5 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 390D64FF-1DB7-4DD1-ADEF-CE96BEA2607C (string)

versionEndExcluding : 4.14.259 (string)

versionStartIncluding : 4.10 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 2D0D89BC-6CF8-4BFB-8C91-472348052528 (string)

versionEndExcluding : 4.19.222 (string)

versionStartIncluding : 4.15 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 195EBAA1-4CCE-4898-9351-F4A0DBCAA022 (string)

versionEndExcluding : 5.4.168 (string)

versionStartIncluding : 4.20 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A657B2D0-5B9D-42BE-A3BF-228DBC1B057C (string)

versionEndExcluding : 5.10.88 (string)

versionStartIncluding : 5.5 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 11274E95-438A-449A-B100-01B2B0046669 (string)

versionEndExcluding : 5.15.11 (string)

versionStartIncluding : 5.11 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF. In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`. The KASAN logs are as follows: [ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0 (string)

}

1 : { »

lang : es (string)

value : En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: igbvf: corrige double free en `igbvf_probe` En `igbvf_probe`, si Register_netdev() falla, el programa irá a la etiqueta err_hw_init y luego a la etiqueta err_ioremap. En free_netdev(), que está justo debajo de la etiqueta err_ioremap, están `list_for_each_entry_safe` y `netif_napi_del` que tienen como objetivo eliminar todas las entradas en `dev->napi_list`. El programa ha agregado una entrada `adapter->rx_ring->napi` que se agrega mediante `netif_napi_add` en igbvf_alloc_queues(). Sin embargo, adaptador->rx_ring se ha liberado debajo de la etiqueta err_hw_init. Entonces esto es una UAF. En términos de cómo solucionar el problema, podemos consultar igbvf_remove() y eliminar la entrada antes de `adapter->rx_ring`. Los registros de KASAN son los siguientes: [35.126075] ERROR: KASAN: use-after-free en free_netdev+0x1fd/0x450 [35.127170] Lectura de tamaño 8 en la dirección ffff88810126d990 mediante la tarea modprobe/366 [35.128360] [35.128643] CPU: 1 PID : 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Nombre del hardware: PC estándar QEMU (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01 /2014 [35.131749] Seguimiento de llamadas: [35.132199] dump_stack_lvl+0x59/0x7b [35.132865] print_address_description+0x7c/0x3b0 [35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808 ] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] por tarea 366: [35.166414] ____kasan_kmalloc+0xc4/0xf0 [35.167117] foo_kmem_cache_alloc_trace+0x3c/ 0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713 ] [35.179993] Liberado por la tarea 366: [35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 vf] [35.184040] local_pci_probe+0x13c/0x1f0 (string)

}

]

id : CVE-2021-47589 (string)

lastModified : 2024-11-21T06:36:36.933 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-06-19T15:15:53.490 (string)

references : [ »

0 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411 (string)

}

1 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49 (string)

}

2 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a (string)

}

3 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc (string)

}

4 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54 (string)

}

5 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028 (string)

}

6 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac (string)

}

7 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb (string)

}

8 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411 (string)

}

9 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49 (string)

}

10 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a (string)

}

11 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc (string)

}

12 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54 (string)

}

13 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028 (string)

}

14 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac (string)

}

15 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb (string)

}

]

sourceIdentifier : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-415 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"bugzilla": {"description": "kernel: igbvf: fix double free in `igbvf_probe`", "id": "2293239", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293239"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-415", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nigbvf: fix double free in `igbvf_probe`\nIn `igbvf_probe`, if register_netdev() fails, the program will go to\nlabel err_hw_init, and then to label err_ioremap. In free_netdev() which\nis just below label err_ioremap, there is `list_for_each_entry_safe` and\n`netif_napi_del` which aims to delete all entries in `dev->napi_list`.\nThe program has added an entry `adapter->rx_ring->napi` which is added by\n`netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has\nbeen freed below label err_hw_init. So this a UAF.\nIn terms of how to patch the problem, we can refer to igbvf_remove() and\ndelete the entry before `adapter->rx_ring`.\nThe KASAN logs are as follows:\n[   35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450\n[   35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366\n[   35.128360]\n[   35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14\n[   35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[   35.131749] Call Trace:\n[   35.132199]  dump_stack_lvl+0x59/0x7b\n[   35.132865]  print_address_description+0x7c/0x3b0\n[   35.133707]  ? free_netdev+0x1fd/0x450\n[   35.134378]  __kasan_report+0x160/0x1c0\n[   35.135063]  ? free_netdev+0x1fd/0x450\n[   35.135738]  kasan_report+0x4b/0x70\n[   35.136367]  free_netdev+0x1fd/0x450\n[   35.137006]  igbvf_probe+0x121d/0x1a10 [igbvf]\n[   35.137808]  ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf]\n[   35.138751]  local_pci_probe+0x13c/0x1f0\n[   35.139461]  pci_device_probe+0x37e/0x6c0\n[   35.165526]\n[   35.165806] Allocated by task 366:\n[   35.166414]  ____kasan_kmalloc+0xc4/0xf0\n[   35.167117]  foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf]\n[   35.168078]  igbvf_probe+0x9c5/0x1a10 [igbvf]\n[   35.168866]  local_pci_probe+0x13c/0x1f0\n[   35.169565]  pci_device_probe+0x37e/0x6c0\n[   35.179713]\n[   35.179993] Freed by task 366:\n[   35.180539]  kasan_set_track+0x4c/0x80\n[   35.181211]  kasan_set_free_info+0x1f/0x40\n[   35.181942]  ____kasan_slab_free+0x103/0x140\n[   35.182703]  kfree+0xe3/0x250\n[   35.183239]  igbvf_probe+0x1173/0x1a10 [igbvf]\n[   35.184040]  local_pci_probe+0x13c/0x1f0"], "name": "CVE-2021-47589", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47589\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47589\nhttps://lore.kernel.org/linux-cve-announce/2024061918-CVE-2021-47589-d405@gregkh/T"], "threat_severity": "Low"}

{

bugzilla : { »

description : kernel: igbvf: fix double free in `igbvf_probe` (string)

id : 2293239 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2293239 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 4.4 (string)

cvss3_scoring_vector : CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (string)

status : draft (string)

}

cwe : CWE-415 (string)

details : [ »

0 : In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF. In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`. The KASAN logs are as follows: [ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0 (string)

]

name : CVE-2021-47589 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : kernel (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

fix_state : Not affected (string)

package_name : kernel (string)

product_name : Red Hat Enterprise Linux 7 (string)

}

2 : { »

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

fix_state : Not affected (string)

package_name : kernel-rt (string)

product_name : Red Hat Enterprise Linux 7 (string)

}

3 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

fix_state : Not affected (string)

package_name : kernel (string)

product_name : Red Hat Enterprise Linux 8 (string)

}

4 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

fix_state : Not affected (string)

package_name : kernel-rt (string)

product_name : Red Hat Enterprise Linux 8 (string)

}

5 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : kernel (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

6 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : kernel-rt (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

]

public_date : 2024-06-19T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2021-47589 https://nvd.nist.gov/vuln/detail/CVE-2021-47589 https://lore.kernel.org/linux-cve-announce/2024061918-CVE-2021-47589-d405@gregkh/T (string)

]

threat_severity : Low (string)

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object