Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47483— regmap: Fix possible double-free in regcache_rbtree_exit()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于regcache_rbtree_exit函数中存在双重释放问题。

CVSS 7.8 · High EPSS 0.23% · P13

Possible ATT&CK Techniques 1 AI

T1564.008 · Email Hiding Rules

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 3f4ff561bc88b074d5e868dde4012d89cbb06c87< e72dce9afbdbfa70d9b44f5908a50ff6c4858999 affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87< fc081477b47dfc3a6cb50a96087fc29674013fc2 affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87< 758ced2c3878ff789801e6fee808e185c5cf08d6 affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87< 3dae1a4eced3ee733d7222e69b8a55caf2d61091 affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87< 1cead23c1c0bc766dacb900a3b0269f651ad596f affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87< 36e911a16b377bde0ad91a8c679069d0d310b1a6 affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87< 50cc1462a668dc62949a1127388bc3af785ce047 affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87< 55e6d8037805b3400096d621091dfbf713f97e83 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47483

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
regmap: Fix possible double-free in regcache_rbtree_exit()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnode->block' will be freed again in regcache_rbtree_exit(), KASAN will report double-free as follows: BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/0x1310 __regmap_init+0x3151/0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 really_probe+0x285/0xc30 To fix this, moving up the assignment of rbnode->block to immediately after the reallocation has succeeded so that the data structure stays valid even if the second reallocation fails.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于regcache_rbtree_exit函数中存在双重释放问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3f4ff561bc88b074d5e868dde4012d89cbb06c87 ~ e72dce9afbdbfa70d9b44f5908a50ff6c4858999 -
Linux Linux 3.12 -

II. Public POCs for CVE-2021-47483

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47483

请登录查看更多情报信息。

Patches & Fixes for CVE-2021-47483 (1)

Other References for CVE-2021-47483 (7)

Same Patch Batch · Linux · 2024-05-22 · 63 CVEs total

CVE-2021-47496 9.8 CRITICAL net/tls: Fix flipped sign in tls_err_abort() calls
CVE-2021-47478 9.1 CRITICAL isofs: Fix out of bound access for corrupted isofs image
CVE-2021-47450 8.8 HIGH KVM: arm64: Fix host stage-2 PGD refcount
CVE-2021-47433 8.1 HIGH btrfs: fix abort logic in btrfs_replace_file_extents
CVE-2021-47451 7.8 HIGH netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
CVE-2021-47459 7.8 HIGH can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
CVE-2021-47461 7.8 HIGH userfaultfd: fix a race between writeprotect and exit_mmap()
CVE-2021-47494 7.8 HIGH cfg80211: fix management registrations locking
CVE-2021-47493 7.8 HIGH ocfs2: fix race between searching chunks and release journal_head from buffer_head
CVE-2021-47492 7.8 HIGH mm, thp: bail out early in collapse_file for writeback page
CVE-2021-47447 7.8 HIGH drm/msm/a3xx: fix error handling in a3xx_gpu_init()
CVE-2021-47485 7.8 HIGH IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
CVE-2021-47446 7.8 HIGH drm/msm/a4xx: fix error handling in a4xx_gpu_init()
CVE-2021-47448 7.5 HIGH mptcp: fix possible stall on recvmsg()
CVE-2021-47465 7.1 HIGH KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
CVE-2021-47438 7.1 HIGH net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path
CVE-2021-47458 7.1 HIGH ocfs2: mount fails with buffer overflow in strlen
CVE-2021-47476 comedi: ni_usb6501: fix NULL-deref in command paths
CVE-2021-47479 staging: rtl8712: fix use-after-free in rtl8712_dl_fw
CVE-2021-47474 comedi: vmk80xx: fix bulk-buffer overflow

Showing top 20 of 63 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47483

No comments yet

Leave a comment