{"timestamp":"2024-09-10T15:38:43.542695Z","id":"CVE-2021-47349","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/marvell/mwifiex/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a05829a7222e9d10c416dd2dbbf3929fe6646b89","lessThan":"a3041d39d3c14da97fa3476835aba043ba810cf0","versionType":"git","status":"affected"},{"version":"a05829a7222e9d10c416dd2dbbf3929fe6646b89","lessThan":"35af69c7c0490fdccfc159c6a87e4d1dc070838a","versionType":"git","status":"affected"},{"version":"a05829a7222e9d10c416dd2dbbf3929fe6646b89","lessThan":"1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/marvell/mwifiex/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"5.12.18","lessThanOrEqual":"5.12.*","versionType":"semver","status":"unaffected"},{"version":"5.13.3","lessThanOrEqual":"5.13.*","versionType":"semver","status":"unaffected"},{"version":"5.14","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST CWE-667

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.12 up to (excluding) 5.12.18
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.13 up to (excluding) 5.13.3

https://git.kernel.org/stable/c/1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e No Types Assigned

https://git.kernel.org/stable/c/1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e Patch

https://git.kernel.org/stable/c/1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e No Types Assigned

https://git.kernel.org/stable/c/1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e Patch

https://git.kernel.org/stable/c/35af69c7c0490fdccfc159c6a87e4d1dc070838a No Types Assigned

https://git.kernel.org/stable/c/35af69c7c0490fdccfc159c6a87e4d1dc070838a Patch

https://git.kernel.org/stable/c/35af69c7c0490fdccfc159c6a87e4d1dc070838a No Types Assigned

https://git.kernel.org/stable/c/35af69c7c0490fdccfc159c6a87e4d1dc070838a Patch

https://git.kernel.org/stable/c/a3041d39d3c14da97fa3476835aba043ba810cf0 No Types Assigned

https://git.kernel.org/stable/c/a3041d39d3c14da97fa3476835aba043ba810cf0 Patch

https://git.kernel.org/stable/c/a3041d39d3c14da97fa3476835aba043ba810cf0 No Types Assigned

https://git.kernel.org/stable/c/a3041d39d3c14da97fa3476835aba043ba810cf0 Patch

https://git.kernel.org/stable/c/1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e

https://git.kernel.org/stable/c/35af69c7c0490fdccfc159c6a87e4d1dc070838a

https://git.kernel.org/stable/c/a3041d39d3c14da97fa3476835aba043ba810cf0

In the Linux kernel, the following vulnerability has been resolved:

mwifiex: bring down link before deleting interface

We can deadlock when rmmod'ing the driver or going through firmware
reset, because the cfg80211_unregister_wdev() has to bring down the link
for us, ... which then grab the same wiphy lock.

nl80211_del_interface() already handles a very similar case, with a nice
description:

        /*
         * We hold RTNL, so this is safe, without RTNL opencount cannot
         * reach 0, and thus the rdev cannot be deleted.
         *
         * We need to do it for the dev_close(), since that will call
         * the netdev notifiers, and we need to acquire the mutex there
         * but don't know if we get there from here or from some other
         * place (e.g. "ip link set ... down").
         */
        mutex_unlock(&rdev->wiphy.mtx);
...

Do similarly for mwifiex teardown, by ensuring we bring the link down
first.

Sample deadlock trace:

[  247.103516] INFO: task rmmod:2119 blocked for more than 123 seconds.
[  247.110630]       Not tainted 5.12.4 #5
[  247.115796] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  247.124557] task:rmmod           state:D stack:    0 pid: 2119 ppid:  2114 flags:0x00400208
[  247.133905] Call trace:
[  247.136644]  __switch_to+0x130/0x170
[  247.140643]  __schedule+0x714/0xa0c
[  247.144548]  schedule_preempt_disabled+0x88/0xf4
[  247.149714]  __mutex_lock_common+0x43c/0x750
[  247.154496]  mutex_lock_nested+0x5c/0x68
[  247.158884]  cfg80211_netdev_notifier_call+0x280/0x4e0 [cfg80211]
[  247.165769]  raw_notifier_call_chain+0x4c/0x78
[  247.170742]  call_netdevice_notifiers_info+0x68/0xa4
[  247.176305]  __dev_close_many+0x7c/0x138
[  247.180693]  dev_close_many+0x7c/0x10c
[  247.184893]  unregister_netdevice_many+0xfc/0x654
[  247.190158]  unregister_netdevice_queue+0xb4/0xe0
[  247.195424]  _cfg80211_unregister_wdev+0xa4/0x204 [cfg80211]
[  247.201816]  cfg80211_unregister_wdev+0x20/0x2c [cfg80211]
[  247.208016]  mwifiex_del_virtual_

kernel.org https://git.kernel.org/stable/c/1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e [No types assigned]

kernel.org https://git.kernel.org/stable/c/35af69c7c0490fdccfc159c6a87e4d1dc070838a [No types assigned]

kernel.org https://git.kernel.org/stable/c/a3041d39d3c14da97fa3476835aba043ba810cf0 [No types assigned]