cve-2021-47494
Vulnerability from cvelistv5
Published
2024-05-22 08:19
Modified
2024-12-19 07:43
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix management registrations locking The management registrations locking was broken, the list was locked for each wdev, but cfg80211_mgmt_registrations_update() iterated it without holding all the correct spinlocks, causing list corruption. Rather than trying to fix it with fine-grained locking, just move the lock to the wiphy/rdev (still need the list on each wdev), we already need to hold the wdev lock to change it, so there's no contention on the lock in any case. This trivially fixes the bug since we hold one wdev's lock already, and now will hold the lock that protects all lists.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4
Impacted products
Vendor Product Version
Linux Linux Version: 6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d
Version: 6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d
Version: 6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d
 Create a notification for this product.
   Linux Linux Version: 5.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2021-47494",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-05-22T18:38:36.269063Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:15:18.041Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T05:39:59.605Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "include/net/cfg80211.h",
                  "net/wireless/core.c",
                  "net/wireless/core.h",
                  "net/wireless/mlme.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "4c22227e39c7a0b4dab55617ee8d34d171fab8d4",
                     status: "affected",
                     version: "6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d",
                     versionType: "git",
                  },
                  {
                     lessThan: "3c897f39b71fe68f90599f6a45b5f7bf5618420e",
                     status: "affected",
                     version: "6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d",
                     versionType: "git",
                  },
                  {
                     lessThan: "09b1d5dc6ce1c9151777f6c4e128a59457704c97",
                     status: "affected",
                     version: "6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "include/net/cfg80211.h",
                  "net/wireless/core.c",
                  "net/wireless/core.h",
                  "net/wireless/mlme.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "5.8",
                  },
                  {
                     lessThan: "5.8",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.10.*",
                     status: "unaffected",
                     version: "5.10.77",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.14.*",
                     status: "unaffected",
                     version: "5.14.16",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "5.15",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\ncfg80211: fix management registrations locking\n\nThe management registrations locking was broken, the list was\nlocked for each wdev, but cfg80211_mgmt_registrations_update()\niterated it without holding all the correct spinlocks, causing\nlist corruption.\n\nRather than trying to fix it with fine-grained locking, just\nmove the lock to the wiphy/rdev (still need the list on each\nwdev), we already need to hold the wdev lock to change it, so\nthere's no contention on the lock in any case. This trivially\nfixes the bug since we hold one wdev's lock already, and now\nwill hold the lock that protects all lists.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T07:43:32.671Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4",
            },
            {
               url: "https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e",
            },
            {
               url: "https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97",
            },
         ],
         title: "cfg80211: fix management registrations locking",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2021-47494",
      datePublished: "2024-05-22T08:19:42.083Z",
      dateReserved: "2024-05-22T06:20:56.201Z",
      dateUpdated: "2024-12-19T07:43:32.671Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2021-47494\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-22T09:15:11.270\",\"lastModified\":\"2024-11-21T06:36:19.770\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncfg80211: fix management registrations locking\\n\\nThe management registrations locking was broken, the list was\\nlocked for each wdev, but cfg80211_mgmt_registrations_update()\\niterated it without holding all the correct spinlocks, causing\\nlist corruption.\\n\\nRather than trying to fix it with fine-grained locking, just\\nmove the lock to the wiphy/rdev (still need the list on each\\nwdev), we already need to hold the wdev lock to change it, so\\nthere's no contention on the lock in any case. This trivially\\nfixes the bug since we hold one wdev's lock already, and now\\nwill hold the lock that protects all lists.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvió la siguiente vulnerabilidad: cfg80211: corrige el bloqueo de registros de administración. El bloqueo de registros de administración estaba roto, la lista estaba bloqueada para cada wdev, pero cfg80211_mgmt_registrations_update() la repitió sin mantener todos los spinlocks correctos, lo que provocó corrupción en la lista. En lugar de intentar solucionarlo con un bloqueo detallado, simplemente mueva el bloqueo a wiphy/rdev (aún necesitamos la lista en cada wdev), ya necesitamos mantener presionado el bloqueo wdev para cambiarlo, por lo que no hay contención en el bloqueo. En todo caso. Esto soluciona trivialmente el error ya que ya tenemos un bloqueo de wdev y ahora mantendremos el bloqueo que protege todas las listas.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.605Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47494\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-22T18:38:36.269063Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-22T18:38:42.817Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"cfg80211: fix management registrations locking\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6cd536fe62ef\", \"lessThan\": \"4c22227e39c7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6cd536fe62ef\", \"lessThan\": \"3c897f39b71f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6cd536fe62ef\", \"lessThan\": \"09b1d5dc6ce1\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/cfg80211.h\", \"net/wireless/core.c\", \"net/wireless/core.h\", \"net/wireless/mlme.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.77\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/cfg80211.h\", \"net/wireless/core.c\", \"net/wireless/core.h\", \"net/wireless/mlme.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\"}, {\"url\": \"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\"}, {\"url\": \"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\"}], \"x_generator\": {\"engine\": \"bippy-c8e10e5f6187\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncfg80211: fix management registrations locking\\n\\nThe management registrations locking was broken, the list was\\nlocked for each wdev, but cfg80211_mgmt_registrations_update()\\niterated it without holding all the correct spinlocks, causing\\nlist corruption.\\n\\nRather than trying to fix it with fine-grained locking, just\\nmove the lock to the wiphy/rdev (still need the list on each\\nwdev), we already need to hold the wdev lock to change it, so\\nthere's no contention on the lock in any case. This trivially\\nfixes the bug since we hold one wdev's lock already, and now\\nwill hold the lock that protects all lists.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-04T11:42:22.947Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2021-47494\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-04T11:42:22.947Z\", \"dateReserved\": \"2024-05-22T06:20:56.201Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-22T08:19:42.083Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.