CVE-2021-46932

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-46932
In the Linux kernel, the following vulnerability has been resolved: Input: appletouch - initialize work before device registration Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means missing work initialization. This may happen, since input_dev->close() calls cancel_work_sync(&dev->work), but dev->work initalization happens _after_ input_register_device() call. So this patch moves dev->work initialization before registering input device

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/292d2ac61fb0d9276a0f7b7ce4f50426f2a1c99f Patch
https://git.kernel.org/stable/c/975774ea7528b489930b76a77ffc4d5379b95ff2 Patch
https://git.kernel.org/stable/c/9f329d0d6c91142cf0ad08d23c72dd195db2633c Patch
https://git.kernel.org/stable/c/9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0 Patch
https://git.kernel.org/stable/c/a02e1404e27855089d2b0a0acc4652c2ce65fe46 Patch
https://git.kernel.org/stable/c/d1962f263a176f493400b8f91bfbf2bfedce951e Patch
https://git.kernel.org/stable/c/d2cb2bf39a6d17ef4bdc0e59c1a35cf5751ad8f4 Patch
https://git.kernel.org/stable/c/e79ff8c68acb1eddf709d3ac84716868f2a91012 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

10 Apr 2024, 18:02

Type Values Removed Values Added
CWE CWE-665
References () https://git.kernel.org/stable/c/292d2ac61fb0d9276a0f7b7ce4f50426f2a1c99f - () https://git.kernel.org/stable/c/292d2ac61fb0d9276a0f7b7ce4f50426f2a1c99f - Patch
References () https://git.kernel.org/stable/c/975774ea7528b489930b76a77ffc4d5379b95ff2 - () https://git.kernel.org/stable/c/975774ea7528b489930b76a77ffc4d5379b95ff2 - Patch
References () https://git.kernel.org/stable/c/9f329d0d6c91142cf0ad08d23c72dd195db2633c - () https://git.kernel.org/stable/c/9f329d0d6c91142cf0ad08d23c72dd195db2633c - Patch
References () https://git.kernel.org/stable/c/9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0 - () https://git.kernel.org/stable/c/9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0 - Patch
References () https://git.kernel.org/stable/c/a02e1404e27855089d2b0a0acc4652c2ce65fe46 - () https://git.kernel.org/stable/c/a02e1404e27855089d2b0a0acc4652c2ce65fe46 - Patch
References () https://git.kernel.org/stable/c/d1962f263a176f493400b8f91bfbf2bfedce951e - () https://git.kernel.org/stable/c/d1962f263a176f493400b8f91bfbf2bfedce951e - Patch
References () https://git.kernel.org/stable/c/d2cb2bf39a6d17ef4bdc0e59c1a35cf5751ad8f4 - () https://git.kernel.org/stable/c/d2cb2bf39a6d17ef4bdc0e59c1a35cf5751ad8f4 - Patch
References () https://git.kernel.org/stable/c/e79ff8c68acb1eddf709d3ac84716868f2a91012 - () https://git.kernel.org/stable/c/e79ff8c68acb1eddf709d3ac84716868f2a91012 - Patch
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

27 Feb 2024, 14:20

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Entrada: appletouch: inicializa el trabajo antes del registro del dispositivo Syzbot ha informado una advertencia en __flush_work(). Esta advertencia es causada por work->func == NULL, lo que significa que falta la inicialización del trabajo. Esto puede suceder, ya que input_dev->close() llama a cancel_work_sync(&dev->work), pero la inicialización dev->work ocurre _después_ de la llamada input_register_device(). Entonces este parche mueve la inicialización dev->work antes de registrar el dispositivo de entrada

27 Feb 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-27 10:15

Updated : 2024-04-10 18:02

NVD link : CVE-2021-46932

Mitre link : CVE-2021-46932

CVE.ORG link : CVE-2021-46932

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-665

Improper Initialization