CVE-2021-47190

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47190
In the Linux kernel, the following vulnerability has been resolved: perf bpf: Avoid memory leak from perf_env__insert_btf() perf_env__insert_btf() doesn't insert if a duplicate BTF id is encountered and this causes a memory leak. Modify the function to return a success/error value and then free the memory if insertion didn't happen. v2. Adds a return -1 when the insertion error occurs in perf_env__fetch_btf. This doesn't affect anything as the result is never checked.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/11589d3144bc4e272e0aae46ce8156162e99babc Patch
https://git.kernel.org/stable/c/4924b1f7c46711762fd0e65c135ccfbcfd6ded1f Patch
https://git.kernel.org/stable/c/642fc22210a5e59d40b1e4d56d21ec3effd401f2 Patch
https://git.kernel.org/stable/c/ab7c3d8d81c511ddfb27823fb07081c96422b56e Patch
https://git.kernel.org/stable/c/11589d3144bc4e272e0aae46ce8156162e99babc Patch
https://git.kernel.org/stable/c/4924b1f7c46711762fd0e65c135ccfbcfd6ded1f Patch
https://git.kernel.org/stable/c/642fc22210a5e59d40b1e4d56d21ec3effd401f2 Patch
https://git.kernel.org/stable/c/ab7c3d8d81c511ddfb27823fb07081c96422b56e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Jan 2025, 17:11

Type Values Removed Values Added
CWE CWE-401
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/11589d3144bc4e272e0aae46ce8156162e99babc - () https://git.kernel.org/stable/c/11589d3144bc4e272e0aae46ce8156162e99babc - Patch
References () https://git.kernel.org/stable/c/4924b1f7c46711762fd0e65c135ccfbcfd6ded1f - () https://git.kernel.org/stable/c/4924b1f7c46711762fd0e65c135ccfbcfd6ded1f - Patch
References () https://git.kernel.org/stable/c/642fc22210a5e59d40b1e4d56d21ec3effd401f2 - () https://git.kernel.org/stable/c/642fc22210a5e59d40b1e4d56d21ec3effd401f2 - Patch
References () https://git.kernel.org/stable/c/ab7c3d8d81c511ddfb27823fb07081c96422b56e - () https://git.kernel.org/stable/c/ab7c3d8d81c511ddfb27823fb07081c96422b56e - Patch

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/11589d3144bc4e272e0aae46ce8156162e99babc - () https://git.kernel.org/stable/c/11589d3144bc4e272e0aae46ce8156162e99babc -
References () https://git.kernel.org/stable/c/4924b1f7c46711762fd0e65c135ccfbcfd6ded1f - () https://git.kernel.org/stable/c/4924b1f7c46711762fd0e65c135ccfbcfd6ded1f -
References () https://git.kernel.org/stable/c/642fc22210a5e59d40b1e4d56d21ec3effd401f2 - () https://git.kernel.org/stable/c/642fc22210a5e59d40b1e4d56d21ec3effd401f2 -
References () https://git.kernel.org/stable/c/ab7c3d8d81c511ddfb27823fb07081c96422b56e - () https://git.kernel.org/stable/c/ab7c3d8d81c511ddfb27823fb07081c96422b56e -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf bpf: Evitar pérdida de memoria de perf_env__insert_btf() perf_env__insert_btf() no se inserta si se encuentra un ID de BTF duplicado y esto provoca una pérdida de memoria. Modifique la función para que devuelva un valor de éxito/error y luego libere la memoria si la inserción no ocurrió. v2. Agrega un retorno -1 cuando ocurre el error de inserción en perf_env__fetch_btf. Esto no afecta a nada ya que el resultado nunca se verifica.

10 Apr 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-10 19:15

Updated : 2025-01-07 17:11

NVD link : CVE-2021-47190

Mitre link : CVE-2021-47190

CVE.ORG link : CVE-2021-47190

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime