CVE-2021-47436

一、漏洞信息
漏洞编号：CVE-2021-47436
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:usb: musb: dsps: Fix the probe error pathCommit 7c75bde329d7 ( usb: musb: musb_dsps: request_irq() afterinitializing musb ) has inverted the calls todsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() withoutupdating correctly the error path. dsps_create_musb_pdev() allocates andregisters a new platform device which must be unregistered and freedwith platform_device_unregister(), and this is missing upondsps_setup_optional_vbus_irq() error.While on the master branch it seems not to trigger any issue, I observeda kernel crash because of a NULL pointer dereference with a v5.10.70stable kernel where the patch mentioned above was backported. With thiskernel version, -EPROBE_DEFER is returned the first timedsps_setup_optional_vbus_irq() is called which triggers the probe toerror out without unregistering the platform device. Unfortunately, onthe Beagle Bone Black Wireless, the platform device still living in thesystem is being used by the USB Ethernet gadget driver, which during theboot phase triggers the crash.My limited knowledge of the musb world prevents me to revert this commitwhich was sent to silence a robot warning which, as far as I understand,does not make sense. The goal of this patch was to prevent an IRQ tofire before the platform device being registered. I think this cannotever happen due to the fact that enabling the interrupts is done by the->enable() callback of the platform musb device, and this platformdevice must be already registered in order for the core or any otheruser to use this callback.Hence, I decided to fix the error path, which might prevent futureerrors on mainline kernels while also fixing older ones.
漏洞公开时间：2024-05-22 15:15:08
漏洞创建时间：2024-05-22 15:50:50
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2021-47436

更多参考(点击展开)

参考来源	参考链接	来源链接
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9ab5d539bc975b8dcde86eca1b58d836b657732e
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9d89e287116796bf987cc48f5c8632ef3048f8eb
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c2115b2b16421d93d4993f3fe4c520e91d6fe801
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e923bce31ffefe4f60edfc6b84f62d4a858f3676
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ff9249aab39820be11b6975a10d94253b7d426fc
suse_bugzilla	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47436	https://bugzilla.suse.com/show_bug.cgi?id=1225244
suse_bugzilla	https://www.cve.org/CVERecord?id=CVE-2021-47436	https://bugzilla.suse.com/show_bug.cgi?id=1225244
suse_bugzilla	https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c	https://bugzilla.suse.com/show_bug.cgi?id=1225244
suse_bugzilla	https://git.kernel.org/stable/c/9ab5d539bc975b8dcde86eca1b58d836b657732e	https://bugzilla.suse.com/show_bug.cgi?id=1225244
suse_bugzilla	https://git.kernel.org/stable/c/9d89e287116796bf987cc48f5c8632ef3048f8eb	https://bugzilla.suse.com/show_bug.cgi?id=1225244
suse_bugzilla	https://git.kernel.org/stable/c/c2115b2b16421d93d4993f3fe4c520e91d6fe801	https://bugzilla.suse.com/show_bug.cgi?id=1225244
suse_bugzilla	https://git.kernel.org/stable/c/e923bce31ffefe4f60edfc6b84f62d4a858f3676	https://bugzilla.suse.com/show_bug.cgi?id=1225244
suse_bugzilla	https://git.kernel.org/stable/c/ff9249aab39820be11b6975a10d94253b7d426fc	https://bugzilla.suse.com/show_bug.cgi?id=1225244
suse_bugzilla	https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47436.mbox	https://bugzilla.suse.com/show_bug.cgi?id=1225244
ubuntu	https://www.cve.org/CVERecord?id=CVE-2021-47436	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://git.kernel.org/linus/c2115b2b16421d93d4993f3fe4c520e91d6fe801 (5.15-rc6)	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://git.kernel.org/stable/c/e923bce31ffefe4f60edfc6b84f62d4a858f3676	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://git.kernel.org/stable/c/9ab5d539bc975b8dcde86eca1b58d836b657732e	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://git.kernel.org/stable/c/9d89e287116796bf987cc48f5c8632ef3048f8eb	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://git.kernel.org/stable/c/ff9249aab39820be11b6975a10d94253b7d426fc	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://git.kernel.org/stable/c/c2115b2b16421d93d4993f3fe4c520e91d6fe801	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://nvd.nist.gov/vuln/detail/CVE-2021-47436	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://launchpad.net/bugs/cve/CVE-2021-47436	https://ubuntu.com/security/CVE-2021-47436
ubuntu	https://security-tracker.debian.org/tracker/CVE-2021-47436	https://ubuntu.com/security/CVE-2021-47436

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)

影响的包	修复版本	修复补丁	问题引入补丁	来源
linux		https://git.kernel.org/linus/c2115b2b16421d93d4993f3fe4c520e91d6fe801	https://git.kernel.org/linus/7c75bde329d7e2a93cf86a5c15c61f96f1446cdc	ubuntu

二、漏洞分析结构反馈
影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-22.03-LTS-SP4(5.10.0):
10.openEuler-24.03-LTS(6.6.0):
11.openEuler-24.03-LTS-Next(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-22.03-LTS-SP4(5.10.0):
10.openEuler-24.03-LTS(6.6.0):
11.openEuler-24.03-LTS-Next(6.6.0):

Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers.

@YangYingliang ,@jiaoff ,@AlexGuo ,@hanjun-guo ,@woqidaideshi ,@Jackie Liu ,@Zhang Yi ,@colyli ,@ThunderTown ,@htforge ,@Chiqijun ,@冷嘲啊 ,@zhujianwei001 ,@kylin-mayukun ,@wangxiongfeng ,@Kefeng ,@SuperSix173 ,@WangShaoBo ,@Zheng Zucheng ,@陈结松
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后cve-manager将无法正常解析填写内容.

影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响):
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-22.03-LTS-SP4:
10.openEuler-24.03-LTS:
11.openEuler-24.03-LTS-Next:

修复是否涉及abi变化(是/否)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-22.03-LTS-SP4:
10.openEuler-24.03-LTS:
11.openEuler-24.03-LTS-Next:

issue处理具体操作请参考:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

参考网址	关联pr	状态	补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2021-47436	None	None	https://git.kernel.org/stable/c/9ab5d539bc975b8dcde86eca1b58d836b657732e https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c https://git.kernel.org/stable/c/e923bce31ffefe4f60edfc6b84f62d4a858f3676 https://git.kernel.org/stable/c/c2115b2b16421d93d4993f3fe4c520e91d6fe801 https://git.kernel.org/stable/c/9d89e287116796bf987cc48f5c8632ef3048f8eb https://git.kernel.org/stable/c/ff9249aab39820be11b6975a10d94253b7d426fc
https://ubuntu.com/security/CVE-2021-47436	None	None	https://discourse.ubuntu.com/c/ubuntu-pro
https://www.opencve.io/cve/CVE-2021-47436	None	None	https://git.kernel.org/stable/c/9ab5d539bc975b8dcde86eca1b58d836b657732e https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c https://git.kernel.org/stable/c/e923bce31ffefe4f60edfc6b84f62d4a858f3676 https://git.kernel.org/stable/c/c2115b2b16421d93d4993f3fe4c520e91d6fe801 https://git.kernel.org/stable/c/9d89e287116796bf987cc48f5c8632ef3048f8eb https://git.kernel.org/stable/c/ff9249aab39820be11b6975a10d94253b7d426fc
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2021-47436
https://security-tracker.debian.org/tracker/CVE-2021-47436

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

CVE-2021-47436

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

usb: musb: dsps: Fix the probe error path

Commit 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after
initializing musb") has inverted the calls to
dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() without
updating correctly the error path. dsps_create_musb_pdev() allocates and
registers a new platform device which must be unregistered and freed
with platform_device_unregister(), and this is missing upon
dsps_setup_optional_vbus_irq() error.

While on the master branch it seems not to trigger any issue, I observed
a kernel crash because of a NULL pointer dereference with a v5.10.70
stable kernel where the patch mentioned above was backported. With this
kernel version, -EPROBE_DEFER is returned the first time
dsps_setup_optional_vbus_irq() is called which triggers the probe to
error out without unregistering the platform device. Unfortunately, on
the Beagle Bone Black Wireless, the platform device still living in the
system is being used by the USB Ethernet gadget driver, which during the
boot phase triggers the crash.

My limited knowledge of the musb world prevents me to revert this commit
which was sent to silence a robot warning which, as far as I understand,
does not make sense. The goal of this patch was to prevent an IRQ to
fire before the platform device being registered. I think this cannot
ever happen due to the fact that enabling the interrupts is done by the
->enable() callback of the platform musb device, and this platform
device must be already registered in order for the core or any other
user to use this callback.

Hence, I decided to fix the error path, which might prevent future
errors on mainline kernels while also fixing older ones.

openEuler评分:(评分和向量)
5.5
CVSS: 3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP1:不受影响
2.openEuler-20.03-LTS-SP4:不受影响
3.openEuler-22.03-LTS:受影响
4.openEuler-22.03-LTS-SP1:受影响
5.openEuler-22.03-LTS-SP2:受影响
6.openEuler-22.03-LTS-SP3:受影响
7.openEuler-22.03-LTS-SP4:不受影响8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next:不受影响
10.openEuler-24.03-LTS:不受影响
11.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS:否
4.openEuler-22.03-LTS-SP1:否
5.openEuler-22.03-LTS-SP2:否
6.openEuler-22.03-LTS-SP3:否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next:否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否
11.openEuler-22.03-LTS-SP4:否

CVE-2021-47436

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

usb: musb: dsps: Fix the probe error path

Commit 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after
initializing musb") has inverted the calls to
dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() without
updating correctly the error path. dsps_create_musb_pdev() allocates and
registers a new platform device which must be unregistered and freed
with platform_device_unregister(), and this is missing upon
dsps_setup_optional_vbus_irq() error.

While on the master branch it seems not to trigger any issue, I observed
a kernel crash because of a NULL pointer dereference with a v5.10.70
stable kernel where the patch mentioned above was backported. With this
kernel version, -EPROBE_DEFER is returned the first time
dsps_setup_optional_vbus_irq() is called which triggers the probe to
error out without unregistering the platform device. Unfortunately, on
the Beagle Bone Black Wireless, the platform device still living in the
system is being used by the USB Ethernet gadget driver, which during the
boot phase triggers the crash.

My limited knowledge of the musb world prevents me to revert this commit
which was sent to silence a robot warning which, as far as I understand,
does not make sense. The goal of this patch was to prevent an IRQ to
fire before the platform device being registered. I think this cannot
ever happen due to the fact that enabling the interrupts is done by the
->enable() callback of the platform musb device, and this platform
device must be already registered in order for the core or any other
user to use this callback.

Hence, I decided to fix the error path, which might prevent future
errors on mainline kernels while also fixing older ones.

openEuler评分:(评分和向量)
5.5
CVSS: 3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP1:不受影响
2.openEuler-20.03-LTS-SP4:不受影响
3.openEuler-22.03-LTS:不受影响
4.openEuler-22.03-LTS-SP1:受影响
5.openEuler-22.03-LTS-SP2:不受影响
6.openEuler-22.03-LTS-SP3:受影响
7.openEuler-22.03-LTS-SP4:不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next:不受影响
10.openEuler-24.03-LTS:不受影响
11.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS:否
4.openEuler-22.03-LTS-SP1:否
5.openEuler-22.03-LTS-SP2:否
6.openEuler-22.03-LTS-SP3:否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next:否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否
11.openEuler-22.03-LTS-SP4:否

CVE-2021-47436

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

usb: musb: dsps: Fix the probe error path

Commit 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after
initializing musb") has inverted the calls to
dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() without
updating correctly the error path. dsps_create_musb_pdev() allocates and
registers a new platform device which must be unregistered and freed
with platform_device_unregister(), and this is missing upon
dsps_setup_optional_vbus_irq() error.

While on the master branch it seems not to trigger any issue, I observed
a kernel crash because of a NULL pointer dereference with a v5.10.70
stable kernel where the patch mentioned above was backported. With this
kernel version, -EPROBE_DEFER is returned the first time
dsps_setup_optional_vbus_irq() is called which triggers the probe to
error out without unregistering the platform device. Unfortunately, on
the Beagle Bone Black Wireless, the platform device still living in the
system is being used by the USB Ethernet gadget driver, which during the
boot phase triggers the crash.

My limited knowledge of the musb world prevents me to revert this commit
which was sent to silence a robot warning which, as far as I understand,
does not make sense. The goal of this patch was to prevent an IRQ to
fire before the platform device being registered. I think this cannot
ever happen due to the fact that enabling the interrupts is done by the
->enable() callback of the platform musb device, and this platform
device must be already registered in order for the core or any other
user to use this callback.

Hence, I decided to fix the error path, which might prevent future
errors on mainline kernels while also fixing older ones.

openEuler评分:(评分和向量)
5.5
CVSS: 3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP1:不受影响
2.openEuler-20.03-LTS-SP4:不受影响
3.openEuler-22.03-LTS:不受影响
4.openEuler-22.03-LTS-SP1:受影响
5.openEuler-22.03-LTS-SP2:不受影响
6.openEuler-22.03-LTS-SP3:受影响
7.openEuler-22.03-LTS-SP4:不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next:不受影响
10.openEuler-24.03-LTS:不受影响
11.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS:否
4.openEuler-22.03-LTS-SP1:否
5.openEuler-22.03-LTS-SP2:否
6.openEuler-22.03-LTS-SP3:否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next:否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否
11.openEuler-22.03-LTS-SP4:否

src-openEuler / kernel

内容风险标识

评论 (6)

src-openEuler / kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-47436

评论 (6)

搜索帮助

src-openEuler / kernel