linux-cve-announce - CVE-2021-47257: net: ieee802154: fix null deref in parse dev addr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052146-CVE-2021-47257-1d1c@gregkh>
Date: Tue, 21 May 2024 16:20:11 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-47257: net: ieee802154: fix null deref in parse dev addr

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: ieee802154: fix null deref in parse dev addr

Fix a logic error that could result in a null deref if the user sets
the mode incorrectly for the given addr type.

The Linux kernel CVE team has assigned CVE-2021-47257 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.274 with commit 1f95741981c8
	Fixed in 4.14.238 with commit c6998ccfefa6
	Fixed in 4.19.196 with commit 5f728ec65485
	Fixed in 5.4.127 with commit d0f47648b87b
	Fixed in 5.10.45 with commit c7836de2cadd
	Fixed in 5.12.12 with commit fdd51e34f453
	Fixed in 5.13 with commit 9fdd04918a45

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47257
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ieee802154/nl802154.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1f95741981c899c4724647291fec5faa3c777185
	https://git.kernel.org/stable/c/c6998ccfefa652bac3f9b236821e392af43efa1e
	https://git.kernel.org/stable/c/5f728ec65485625e30f46e5b4917ff023ad29ea0
	https://git.kernel.org/stable/c/d0f47648b87b6d5f204cb7f3cbce6d36dab85a67
	https://git.kernel.org/stable/c/c7836de2cadd88bc2f20f2c5a3d4ef4c73aef627
	https://git.kernel.org/stable/c/fdd51e34f45311ab6e48d2147cbc2904731b9993
	https://git.kernel.org/stable/c/9fdd04918a452980631ecc499317881c1d120b70