CVE-2021-46904

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix null-ptr-deref during tty device unregistration

Multiple ttys try to claim the same the minor number causing a double

unregistration of the same device. The first unregistration succeeds

but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number

but doesn't assign it immediately. The assignment is done by the caller

later. But before this assignment, calls to get_free_serial_index()

would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number

immediately after one is found to be and rename it to obtain_minor()

to better reflect what it does. Similary, rename set_serial_by_index()

to release_minor() and modify it to free up the minor number of the

given hso_serial. Every obtain_minor() should have corresponding

release_minor() call.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References