Bug 1197214 - (CVE-2021-39714) VUL-0: CVE-2021-39714: kernel-source-azure,kernel-source-rt,kernel-source: integer overflow leading to use after free in ion.c
(CVE-2021-39714)
VUL-0: CVE-2021-39714: kernel-source-azure,kernel-source-rt,kernel-source: in...
Status: RESOLVED INVALID
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/326480/
CVSSv3.1:SUSE:CVE-2021-39714:7.4:(AV:...
:
Depends on:
Blocks: 1197218
  Show dependency treegraph
 
Reported: 2022-03-17 10:18 UTC by Thomas Leroy
Modified: 2022-03-17 14:45 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2022-03-17 10:18:39 UTC
CVE-2021-39714

In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an
integer overflow. This could lead to local escalation of privilege with no
additional execution privileges needed. User interaction is not needed for
exploitation.Product: AndroidVersions: Android kernelAndroid ID:
A-205573273References: Upstream kernel

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39714
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39714
https://source.android.com/security/bulletin/pixel/2022-03-01
Comment 1 Thomas Leroy 2022-03-17 10:30:23 UTC
This one affects us.

Fixing commit: 16b34e53eaadda6cbb1f0452fd99700c44db23be

Introducing the bug: b892bf75b2034

The fixing commit is only present on master, although the commit introducing the bug is present on the following branches:
- SLE12-SP5
- SLE15-SP3
- SLE15-SP4-GA
- cve/linux-4.12
- cve/linux-4.4
- cve/linux-5.3
- stable
- master

All of these branches except master are affected.
Comment 2 Thomas Leroy 2022-03-17 10:37:34 UTC
However it seems to be a very android-related driver
Comment 3 Takashi Iwai 2022-03-17 14:18:21 UTC
ion driver was in drivers/staging/android, and we haven't enabled it in any releases.  And this driver got already removed.  So we are unaffected.

Reassigned back to security team.
Comment 4 Thomas Leroy 2022-03-17 14:45:21 UTC
(In reply to Takashi Iwai from comment #3)
> ion driver was in drivers/staging/android, and we haven't enabled it in any
> releases.  And this driver got already removed.  So we are unaffected.
> 
> Reassigned back to security team.

Thanks Takashi! Closing