Riskcovery

CVE-2021-47324

watchdog: Fix possible use-after-free in wdt_startup()

State
Published
Severity
8.8 High
Published
May 21, 2024
Updated
May 11, 2026
Reserved
May 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

watchdog: Fix possible use-after-free in wdt_startup()

This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 63a3dc24bd053792f84cb4eef0168b1266202a02Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 862f2b5a7c38762ac9e369daefbf361a91aca685Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0ac50a76cf3cd63db000648b3b19f3f98b8aaa76Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dc9403097be52d57a5c9c35efa9be79d166a78afAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 146cc288fb80c662c9c35e7bc58325d1ac0a7875Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a397cb4576fc2fc802562418b3a50b8f67d60d31Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b4ebf4a4692e84163a69444c70ad515de06e2259Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8adbbe6c86bb13e14f8a19e036ae5f4f5661fd90Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c08a6b31e4917034f0ed0cb457c3bb209576f542Affected
LinuxLinux
  • 2.6.12Affected
  • before 2.6.12Not affected
  • 4.4.276 through 4.4.*Not affected
  • 4.9.276 through 4.9.*Not affected
  • 4.14.240 through 4.14.*Not affected
  • 4.19.198 through 4.19.*Not affected
  • 5.4.134 through 5.4.*Not affected
  • 5.10.52 through 5.10.*Not affected
  • 5.12.19 through 5.12.*Not affected
  • 5.13.4 through 5.13.*Not affected
  • 5.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.