Bug 1221971 (CVE-2021-47151)

Summary:	VUL-0: CVE-2021-47151: kernel: interconnect: qcom: bcm-voter: add a missing of_node_put()
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	gabriel.bertazi, gabriele.sonnu, stanimir.varbanov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/398798/
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-47151:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-03-26 10:49:19 UTC

In the Linux kernel, the following vulnerability has been resolved:

interconnect: qcom: bcm-voter: add a missing of_node_put()

Add a missing of_node_put() in of_bcm_voter_get() to avoid the
reference leak.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47151
https://git.kernel.org/stable/c/a00593737f8bac2c9e97b696e7ff84a4446653e8
https://www.cve.org/CVERecord?id=CVE-2021-47151
https://git.kernel.org/stable/c/4e3cea8035b6f1b9055e69cc6ebf9fa4e50763ae
https://git.kernel.org/stable/c/93d1dbe7043b3c9492bdf396b2e98a008435b55b
https://bugzilla.redhat.com/show_bug.cgi?id=2271485

Comment 1 Gabriele Sonnu 2024-03-26 13:18:58 UTC

Offending commit (976daac4a1c5) found in:
 - ALP-current
 - cve/linux-5.14-LTSS
 - SLE15-SP4-LTSS
 - SLE15-SP5
 - SLE15-SP6
 - stable

Fixing commit (a00593737f8b) found in:
 - ALP-current
 - cve/linux-5.14-LTSS
 - SLE15-SP4-LTSS
 - SLE15-SP5
 - SLE15-SP6
 - stable

All branches fixed. @kernel-team, please add the CVE reference.

Comment 2 Stanimir Varbanov 2024-03-28 10:59:41 UTC

The fixing commit is part of 5.14 before branching (merged in v5.13-rc1) so the reference cannot be updated.

Comment 3 Gabriel Krisman Bertazi 2024-03-28 22:31:31 UTC

Yep, the issue was introduced in 5.7 and fixed in 5.13 so this should be a nop for us.

Comment 4 Andrea Mattiazzo 2024-06-07 12:21:26 UTC

All done, closing.