{"timestamp":"2025-04-22T16:12:25.365291Z","id":"CVE-2021-46933","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/function/f_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5e33f6fdf735cda1d4580fe6f1878da05718fe73","lessThan":"f976dd7011150244a7ba820f2c331e9fb253befa","versionType":"git","status":"affected"},{"version":"5e33f6fdf735cda1d4580fe6f1878da05718fe73","lessThan":"cc8c8028c21b2a3842a1e98e99e55028df275919","versionType":"git","status":"affected"},{"version":"5e33f6fdf735cda1d4580fe6f1878da05718fe73","lessThan":"52500239e3f2d6fc77b6f58632a9fb98fe74ac09","versionType":"git","status":"affected"},{"version":"5e33f6fdf735cda1d4580fe6f1878da05718fe73","lessThan":"33f6a0cbb7772146e1c11f38028fffbfed14728b","versionType":"git","status":"affected"},{"version":"5e33f6fdf735cda1d4580fe6f1878da05718fe73","lessThan":"240fc586e83d645912accce081a48aa63a45f6ee","versionType":"git","status":"affected"},{"version":"5e33f6fdf735cda1d4580fe6f1878da05718fe73","lessThan":"1c4ace3e6b8575745c50dca9e76e0021e697d645","versionType":"git","status":"affected"},{"version":"5e33f6fdf735cda1d4580fe6f1878da05718fe73","lessThan":"ebef2aa29f370b5096c16020c104e393192ef684","versionType":"git","status":"affected"},{"version":"5e33f6fdf735cda1d4580fe6f1878da05718fe73","lessThan":"b1e0887379422975f237d43d8839b751a6bcf154","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/function/f_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.0","status":"affected"},{"version":"0","lessThan":"4.0","versionType":"semver","status":"unaffected"},{"version":"4.4.298","lessThanOrEqual":"4.4.*","versionType":"semver","status":"unaffected"},{"version":"4.9.296","lessThanOrEqual":"4.9.*","versionType":"semver","status":"unaffected"},{"version":"4.14.261","lessThanOrEqual":"4.14.*","versionType":"semver","status":"unaffected"},{"version":"4.19.224","lessThanOrEqual":"4.19.*"

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476

https://git.kernel.org/stable/c/1c4ace3e6b8575745c50dca9e76e0021e697d645

https://git.kernel.org/stable/c/240fc586e83d645912accce081a48aa63a45f6ee

https://git.kernel.org/stable/c/33f6a0cbb7772146e1c11f38028fffbfed14728b

https://git.kernel.org/stable/c/52500239e3f2d6fc77b6f58632a9fb98fe74ac09

https://git.kernel.org/stable/c/b1e0887379422975f237d43d8839b751a6bcf154

https://git.kernel.org/stable/c/cc8c8028c21b2a3842a1e98e99e55028df275919

https://git.kernel.org/stable/c/ebef2aa29f370b5096c16020c104e393192ef684

https://git.kernel.org/stable/c/f976dd7011150244a7ba820f2c331e9fb253befa

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST CWE-416

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.4.298
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.5.0 up to (excluding) 4.9.296
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10.0 up to (excluding) 4.14.261
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15.0 up to (excluding) 4.19.224
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20.0 up to (excluding) 5.4.170
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5.0 up to (excluding) 5.10.90
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11.0 up to (excluding) 5.15.13

https://git.kernel.org/stable/c/1c4ace3e6b8575745c50dca9e76e0021e697d645 No Types Assigned

https://git.kernel.org/stable/c/1c4ace3e6b8575745c50dca9e76e0021e697d645 Patch

https://git.kernel.org/stable/c/240fc586e83d645912accce081a48aa63a45f6ee No Types Assigned

https://git.kernel.org/stable/c/240fc586e83d645912accce081a48aa63a45f6ee Patch

https://git.kernel.org/stable/c/33f6a0cbb7772146e1c11f38028fffbfed14728b No Types Assigned

https://git.kernel.org/stable/c/33f6a0cbb7772146e1c11f38028fffbfed14728b Patch

https://git.kernel.org/stable/c/52500239e3f2d6fc77b6f58632a9fb98fe74ac09 No Types Assigned

https://git.kernel.org/stable/c/52500239e3f2d6fc77b6f58632a9fb98fe74ac09 Patch

https://git.kernel.org/stable/c/b1e0887379422975f237d43d8839b751a6bcf154 No Types Assigned

https://git.kernel.org/stable/c/b1e0887379422975f237d43d8839b751a6bcf154 Patch

https://git.kernel.org/stable/c/cc8c8028c21b2a3842a1e98e99e55028df275919 No Types Assigned

https://git.kernel.org/stable/c/cc8c8028c21b2a3842a1e98e99e55028df275919 Patch

https://git.kernel.org/stable/c/ebef2aa29f370b5096c16020c104e393192ef684 No Types Assigned

https://git.kernel.org/stable/c/ebef2aa29f370b5096c16020c104e393192ef684 Patch

https://git.kernel.org/stable/c/f976dd7011150244a7ba820f2c331e9fb253befa No Types Assigned

https://git.kernel.org/stable/c/f976dd7011150244a7ba820f2c331e9fb253befa Patch

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.

ffs_data_clear is indirectly called from both ffs_fs_kill_sb and
ffs_ep0_release, so it ends up being called twice when userland closes ep0
and then unmounts f_fs.
If userland provided an eventfd along with function's USB descriptors, it
ends up calling eventfd_ctx_put as many times, causing a refcount
underflow.
NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.

Also, set epfiles to NULL right after de-allocating it, for readability.

For completeness, ffs_data_clear actually ends up being called thrice, the
last call being before the whole ffs structure gets freed, so when this
specific sequence happens there is a second underflow happening (but not
being reported):

/sys/kernel/debug/tracing# modprobe usb_f_fs
/sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter
/sys/kernel/debug/tracing# echo function > current_tracer
/sys/kernel/debug/tracing# echo 1 > tracing_on
(setup gadget, run and kill function userland process, teardown gadget)
/sys/kernel/debug/tracing# echo 0 > tracing_on
/sys/kernel/debug/tracing# cat trace
 smartcard-openp-436     [000] .....  1946.208786: ffs_data_clear <-ffs_data_closed
 smartcard-openp-431     [000] .....  1946.279147: ffs_data_clear <-ffs_data_closed
 smartcard-openp-431     [000] .n...  1946.905512: ffs_data_clear <-ffs_data_put

Warning output corresponding to above trace:
[ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c
[ 1946.293094] refcount_t: underflow; use-after-free.
[ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmu

Linux https://git.kernel.org/stable/c/1c4ace3e6b8575745c50dca9e76e0021e697d645 [No types assigned]

Linux https://git.kernel.org/stable/c/240fc586e83d645912accce081a48aa63a45f6ee [No types assigned]

Linux https://git.kernel.org/stable/c/33f6a0cbb7772146e1c11f38028fffbfed14728b [No types assigned]

Linux https://git.kernel.org/stable/c/52500239e3f2d6fc77b6f58632a9fb98fe74ac09 [No types assigned]

Linux https://git.kernel.org/stable/c/b1e0887379422975f237d43d8839b751a6bcf154 [No types assigned]

Linux https://git.kernel.org/stable/c/cc8c8028c21b2a3842a1e98e99e55028df275919 [No types assigned]

Linux https://git.kernel.org/stable/c/ebef2aa29f370b5096c16020c104e393192ef684 [No types assigned]

Linux https://git.kernel.org/stable/c/f976dd7011150244a7ba820f2c331e9fb253befa [No types assigned]