CVE-2021-47355
atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
Reported by linux · Published May 21, 2024
In the Linux kernel, the following vulnerability has been resolved: atm: nicstar: Fix possible use-after-free in nicstar_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
| Linux | Linux | 2.6.12, 0, 4.4.276 |
| linux | linux_kernel | 2.6.12, 2.6.12, 2.6.12 |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
Timeline
- May 21, 2024 CVE Published
- May 22, 2024 EPSS Score (30 in total, the first dated here)
- Jun 2, 2026 Security Advisory
- Jul 13, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-47355
vulnetix vdb fixes CVE-2021-47355Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-47355/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart