CVE-2021-47231

can: mcba_usb: fix memory leak in mcba_usb

State: Published
Severity: 5.5 Medium
Published: May 21, 2024
Updated: May 11, 2026
Reserved: Apr 10, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: fix memory leak in mcba_usb

Syzbot reported memory leak in SocketCAN driver for Microchip CAN BUS Analyzer Tool. The problem was in unfreed usb_coherent.

In mcba_usb_start() 20 coherent buffers are allocated and there is nothing, that frees them:

1) In callback function the urb is resubmitted and that's all 2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER is not set (see mcba_usb_start) and this flag cannot be used with coherent buffers.

Fail log: | [ 1354.053291][ T8413] mcba_usb 1-1:0.0 can0: device disconnected | [ 1367.059384][ T8420] kmemleak: 20 new suspected memory leaks (see /sys/kernel/debug/kmem)

So, all allocated buffers should be freed with usb_free_coherent() explicitly

NOTE: The same pattern for allocating and freeing coherent buffers is used in drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	51f3baad7de943780ce0c17bd7975df567dd6e14 to before 89df95ce32be204eef2e7d4b2f6fb552fb191a68Affected 51f3baad7de943780ce0c17bd7975df567dd6e14 to before a115198caaab6d663bef75823a3c5f0802306d60Affected 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 6f87c0e21ad20dd3d22108e33db1c552dfa352a0Affected 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 6bd3d80d1f019cefa7011056c54b323f1d8b8e83Affected 51f3baad7de943780ce0c17bd7975df567dd6e14 to before d0760a4ef85697bc756d06eae17ae27f3f055401Affected 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 91c02557174be7f72e46ed7311e3bea1939840b0Affected
LinuxLinux	4.12Affected before 4.12Not affected 4.14.238 through 4.14.Not affected 4.19.196 through 4.19.Not affected 5.4.128 through 5.4.Not affected 5.10.46 through 5.10.Not affected 5.12.13 through 5.12.*Not affected 5.13 and laterNot affected

Product

Versions

LinuxLinux

51f3baad7de943780ce0c17bd7975df567dd6e14 to before 89df95ce32be204eef2e7d4b2f6fb552fb191a68Affected
51f3baad7de943780ce0c17bd7975df567dd6e14 to before a115198caaab6d663bef75823a3c5f0802306d60Affected
51f3baad7de943780ce0c17bd7975df567dd6e14 to before 6f87c0e21ad20dd3d22108e33db1c552dfa352a0Affected
51f3baad7de943780ce0c17bd7975df567dd6e14 to before 6bd3d80d1f019cefa7011056c54b323f1d8b8e83Affected
51f3baad7de943780ce0c17bd7975df567dd6e14 to before d0760a4ef85697bc756d06eae17ae27f3f055401Affected
51f3baad7de943780ce0c17bd7975df567dd6e14 to before 91c02557174be7f72e46ed7311e3bea1939840b0Affected

LinuxLinux

4.12Affected
before 4.12Not affected
4.14.238 through 4.14.*Not affected
4.19.196 through 4.19.*Not affected
5.4.128 through 5.4.*Not affected
5.10.46 through 5.10.*Not affected
5.12.13 through 5.12.*Not affected
5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.