Bug 1221970 (CVE-2021-47158) - VUL-0: CVE-2021-47158: kernel: net: dsa: sja1105: add error handling in sja1105_setup()
Summary: VUL-0: CVE-2021-47158: kernel: net: dsa: sja1105: add error handling in sja11...
Status: RESOLVED FIXED
Alias: CVE-2021-47158
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/398812/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-47158:5.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-26 10:49 UTC by SMASH SMASH
Modified: 2024-07-02 07:14 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-03-26 10:49:18 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net: dsa: sja1105: add error handling in sja1105_setup()

If any of sja1105_static_config_load(), sja1105_clocking_setup() or
sja1105_devlink_setup() fails, we can't just return in the middle of
sja1105_setup() or memory will leak. Add a cleanup path.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47158
https://www.cve.org/CVERecord?id=CVE-2021-47158
https://git.kernel.org/stable/c/987e4ab8b8a4fcbf783069e03e7524cd39ffd563
https://git.kernel.org/stable/c/cec279a898a3b004411682f212215ccaea1cd0fb
https://git.kernel.org/stable/c/dd8609f203448ca6d58ae71461208b3f6b0329b0
https://bugzilla.redhat.com/show_bug.cgi?id=2271474
Comment 1 Gabriele Sonnu 2024-03-26 13:28:10 UTC 
Offending commit (8aa9ebccae87) found in:
 - ALP-current
 - cve/linux-5.3-LTSS
 - cve/linux-5.14-LTSS
 - SLE15-SP2-LTSS
 - SLE15-SP3-LTSS
 - SLE15-SP4-LTSS
 - SLE15-SP5
 - SLE15-SP6
 - stable

Fixing commit (cec279a898a3) found in:
 - ALP-current
 - cve/linux-5.14-LTSS
 - SLE15-SP4-LTSS
 - SLE15-SP5
 - SLE15-SP6
 - stable

Tracking as affected:
 - cve/linux-5.3-LTSS
 - SLE15-SP2-LTSS
 - SLE15-SP3-LTSS
Comment 2 Gabriel Krisman Bertazi 2024-04-26 23:01:29 UTC 
This only affects LTSS but it is low score(<7) and really low impact.  From our point of view, we shouldn't handle it.  Back to the security team.