PT-2021-8083 · Linux+4 · Linux Kernel+4
Syzbot
·
Published
2021-12-30
·
Updated
2024-08-14
·
CVE-2021-46932
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the incorrect initialization of
dev->work after calling input register device() in the appletouch component of the Linux kernel. This may cause a warning in flush work() due to work->func == NULL, indicating missing work initialization. The problem occurs because input dev->close() calls cancel work sync(&dev->work), but dev->work initialization happens after the input register device() call.Recommendations
To resolve the issue, move the
dev->work initialization before registering the input device.
As a temporary workaround, consider disabling the cancel work sync() function until a patch is available.
Restrict access to the appletouch component to minimize the risk of exploitation.
Avoid using the dev->work variable in the affected code until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse
Ubuntu