CVE-2021-47358

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47358", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T14:28:16.988Z", "datePublished": "2024-05-21T14:44:50.221Z", "dateUpdated": "2026-08-05T08:47:27.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:47:27.000Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: greybus: uart: fix tty use after free\n\nUser space can hold a tty open indefinitely and tty drivers must not\nrelease the underlying structures until the last user is gone.\n\nSwitch to using the tty-port reference counter to manage the life time\nof the greybus tty state to avoid use after free after a disconnect."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to open and operate on /dev/ttyGB*; the UAF is triggered via local tty syscalls after the greybus UART device is disconnected, matching other greybus disconnect-UAF scores.\nAC:L - The attacker reliably causes the bug by holding the tty open across disconnect and then using the fd; this is a deterministic lifetime violation, not a race or layout-dependent condition beyond attacker control.\nPR:L - An unprivileged local user who can open the greybus tty device is sufficient; no root or init-namespace capabilities are required for the open/use path.\nUI:N - No separate victim action is required; the attacker opens the device and continues using it after disconnect.\nS:U - Impact is confined to the host kernel (memory corruption / privilege escalation within the same security authority); it does not cross a VM, IOMMU, or other security boundary.\nC:H - Use-after-free of the gb_tty/tty_port object allows reclaim and controlled reads of freed kernel heap memory.\nI:H - UAF of a structure embedding tty_port ops enables heap spray and hijacking of function pointers on subsequent close/write paths for arbitrary write/code execution.\nA:H - Dereferencing the freed gb_tty on close, write, or cleanup causes kernel oops/panic even without full exploitation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/greybus/uart.c"], "versions": [{"version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d", "status": "affected", "versionType": "git"}, {"version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "64062fcaca8872f063ec9da011e7bf30470be33f", "status": "affected", "versionType": "git"}, {"version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "a5cfd51f6348e8fd7531461366946039c29c7e69", "status": "affected", "versionType": "git"}, {"version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "4dc56951a8d9d61d364d346c61a5f1d70b4f5e14", "status": "affected", "versionType": "git"}, {"version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "b9e697e60ce9890e9258a73eb061288e7d68e5e6", "status": "affected", "versionType": "git"}, {"version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "9872ff6fdce8b229f01993b611b5d1719cb70ff1", "status": "affected", "versionType": "git"}, {"version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "92dc0b1f46e12cfabd28d709bb34f7a39431b44f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/greybus/uart.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.285", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.249", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.209", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.150", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.70", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14.9", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.9.285"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.14.249"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.19.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.4.150"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.14.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d"}, {"url": "https://git.kernel.org/stable/c/64062fcaca8872f063ec9da011e7bf30470be33f"}, {"url": "https://git.kernel.org/stable/c/a5cfd51f6348e8fd7531461366946039c29c7e69"}, {"url": "https://git.kernel.org/stable/c/4dc56951a8d9d61d364d346c61a5f1d70b4f5e14"}, {"url": "https://git.kernel.org/stable/c/b9e697e60ce9890e9258a73eb061288e7d68e5e6"}, {"url": "https://git.kernel.org/stable/c/9872ff6fdce8b229f01993b611b5d1719cb70ff1"}, {"url": "https://git.kernel.org/stable/c/92dc0b1f46e12cfabd28d709bb34f7a39431b44f"}], "title": "staging: greybus: uart: fix tty use after free", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47358", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-21T18:24:46.611586Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:15:01.010Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.651Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/64062fcaca8872f063ec9da011e7bf30470be33f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a5cfd51f6348e8fd7531461366946039c29c7e69", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4dc56951a8d9d61d364d346c61a5f1d70b4f5e14", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b9e697e60ce9890e9258a73eb061288e7d68e5e6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9872ff6fdce8b229f01993b611b5d1719cb70ff1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/92dc0b1f46e12cfabd28d709bb34f7a39431b44f", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/64062fcaca8872f063ec9da011e7bf30470be33f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a5cfd51f6348e8fd7531461366946039c29c7e69", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4dc56951a8d9d61d364d346c61a5f1d70b4f5e14", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b9e697e60ce9890e9258a73eb061288e7d68e5e6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9872ff6fdce8b229f01993b611b5d1719cb70ff1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/92dc0b1f46e12cfabd28d709bb34f7a39431b44f", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.651Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47358", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-21T18:24:46.611586Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:25.436Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "staging: greybus: uart: fix tty use after free", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to open and operate on /dev/ttyGB*; the UAF is triggered via local tty syscalls after the greybus UART device is disconnected, matching other greybus disconnect-UAF scores.\nAC:L - The attacker reliably causes the bug by holding the tty open across disconnect and then using the fd; this is a deterministic lifetime violation, not a race or layout-dependent condition beyond attacker control.\nPR:L - An unprivileged local user who can open the greybus tty device is sufficient; no root or init-namespace capabilities are required for the open/use path.\nUI:N - No separate victim action is required; the attacker opens the device and continues using it after disconnect.\nS:U - Impact is confined to the host kernel (memory corruption / privilege escalation within the same security authority); it does not cross a VM, IOMMU, or other security boundary.\nC:H - Use-after-free of the gb_tty/tty_port object allows reclaim and controlled reads of freed kernel heap memory.\nI:H - UAF of a structure embedding tty_port ops enables heap spray and hijacking of function pointers on subsequent close/write paths for arbitrary write/code execution.\nA:H - Dereferencing the freed gb_tty on close, write, or cleanup causes kernel oops/panic even without full exploitation."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d", "versionType": "git"}, {"status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "64062fcaca8872f063ec9da011e7bf30470be33f", "versionType": "git"}, {"status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "a5cfd51f6348e8fd7531461366946039c29c7e69", "versionType": "git"}, {"status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "4dc56951a8d9d61d364d346c61a5f1d70b4f5e14", "versionType": "git"}, {"status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "b9e697e60ce9890e9258a73eb061288e7d68e5e6", "versionType": "git"}, {"status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "9872ff6fdce8b229f01993b611b5d1719cb70ff1", "versionType": "git"}, {"status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "lessThan": "92dc0b1f46e12cfabd28d709bb34f7a39431b44f", "versionType": "git"}], "programFiles": ["drivers/staging/greybus/uart.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "4.9.285", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.249", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.209", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.150", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.70", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.14.9", "versionType": "semver", "lessThanOrEqual": "5.14.*"}, {"status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/staging/greybus/uart.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d"}, {"url": "https://git.kernel.org/stable/c/64062fcaca8872f063ec9da011e7bf30470be33f"}, {"url": "https://git.kernel.org/stable/c/a5cfd51f6348e8fd7531461366946039c29c7e69"}, {"url": "https://git.kernel.org/stable/c/4dc56951a8d9d61d364d346c61a5f1d70b4f5e14"}, {"url": "https://git.kernel.org/stable/c/b9e697e60ce9890e9258a73eb061288e7d68e5e6"}, {"url": "https://git.kernel.org/stable/c/9872ff6fdce8b229f01993b611b5d1719cb70ff1"}, {"url": "https://git.kernel.org/stable/c/92dc0b1f46e12cfabd28d709bb34f7a39431b44f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: greybus: uart: fix tty use after free\n\nUser space can hold a tty open indefinitely and tty drivers must not\nrelease the underlying structures until the last user is gone.\n\nSwitch to using the tty-port reference counter to manage the life time\nof the greybus tty state to avoid use after free after a disconnect."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.285", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.249", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.209", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.150", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.70", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.14.9", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15", "versionStartIncluding": "4.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:47:27.000Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47358", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:47:27.000Z", "dateReserved": "2024-05-21T14:28:16.988Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T14:44:50.221Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/staging/greybus/uart.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d", "status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "versionType": "git"}, {"lessThan": "64062fcaca8872f063ec9da011e7bf30470be33f", "status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "versionType": "git"}, {"lessThan": "a5cfd51f6348e8fd7531461366946039c29c7e69", "status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "versionType": "git"}, {"lessThan": "4dc56951a8d9d61d364d346c61a5f1d70b4f5e14", "status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "versionType": "git"}, {"lessThan": "b9e697e60ce9890e9258a73eb061288e7d68e5e6", "status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "versionType": "git"}, {"lessThan": "9872ff6fdce8b229f01993b611b5d1719cb70ff1", "status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "versionType": "git"}, {"lessThan": "92dc0b1f46e12cfabd28d709bb34f7a39431b44f", "status": "affected", "version": "a18e15175708d39abbe9746ddc3479466b7800c3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/staging/greybus/uart.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.285", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.249", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.209", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.150", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.70", "versionType": "semver"}, {"lessThanOrEqual": "5.14.*", "status": "unaffected", "version": "5.14.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF8D6AC2-2AE7-4DD2-8D70-DAFAE0CDB6DC", "versionEndExcluding": "4.9.285", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9DFC8239-9F26-43B2-A340-8EFC6BC6BDA8", "versionEndExcluding": "4.14.249", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "21C23429-F802-4256-B3C2-9EEA76AC11FF", "versionEndExcluding": "4.19.209", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "87771E47-210D-48FA-95BC-48A86225B30F", "versionEndExcluding": "5.4.150", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2A50090-4483-4F44-9147-BF0B012FBF7E", "versionEndExcluding": "5.10.70", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B31D6C1-A751-438D-906B-0C56B789D498", "versionEndExcluding": "5.14.9", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "60134C3A-06E4-48C1-B04F-2903732A4E56", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: greybus: uart: fix tty use after free\n\nUser space can hold a tty open indefinitely and tty drivers must not\nrelease the underlying structures until the last user is gone.\n\nSwitch to using the tty-port reference counter to manage the life time\nof the greybus tty state to avoid use after free after a disconnect."}, {"lang": "es", "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: staging: greybus: uart: corrige el use after free de tty. El espacio de usuario puede mantener un tty abierto indefinidamente y los controladores de tty no deben liberar las estructuras subyacentes hasta que el \u00faltimo usuario se haya ido. Cambie al uso del contador de referencia del puerto tty para administrar la vida \u00fatil del estado tty de greybus para evitar su uso despu\u00e9s de una desconexi\u00f3n."}], "id": "CVE-2021-47358", "lastModified": "2026-08-04T10:16:59.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47358", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-21T18:24:46.611586Z", "version": "2.0.3"}}]}, "published": "2024-05-21T15:15:22.073", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4dc56951a8d9d61d364d346c61a5f1d70b4f5e14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/64062fcaca8872f063ec9da011e7bf30470be33f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92dc0b1f46e12cfabd28d709bb34f7a39431b44f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9872ff6fdce8b229f01993b611b5d1719cb70ff1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a5cfd51f6348e8fd7531461366946039c29c7e69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9e697e60ce9890e9258a73eb061288e7d68e5e6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4dc56951a8d9d61d364d346c61a5f1d70b4f5e14"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/64062fcaca8872f063ec9da011e7bf30470be33f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92dc0b1f46e12cfabd28d709bb34f7a39431b44f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9872ff6fdce8b229f01993b611b5d1719cb70ff1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a5cfd51f6348e8fd7531461366946039c29c7e69"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9e697e60ce9890e9258a73eb061288e7d68e5e6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: staging: greybus: uart: fix tty use after free", "id": "2282392", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282392"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nstaging: greybus: uart: fix tty use after free\nUser space can hold a tty open indefinitely and tty drivers must not\nrelease the underlying structures until the last user is gone.\nSwitch to using the tty-port reference counter to manage the life time\nof the greybus tty state to avoid use after free after a disconnect.", "A use-after-free flaw was in the Linux kernel\u2019s Greybus UART driver when a user held a tty open. This flaw allows a local user to crash the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2021-47358", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47358\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47358\nhttps://lore.kernel.org/linux-cve-announce/2024052151-CVE-2021-47358-3a8d@gregkh/T"], "statement": "This flaw doesn't affect any versions of Red Hat Enterprise Linux, because the kernel config param, CONFIG_GREYBUS_UART, is disabled.", "threat_severity": "Moderate"}

{}