CVE-2021-46959 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2021-46959?

CVE-2021-46959 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's SPI subsystem. When using devm_spi_alloc_* functions, improper cleanup during SPI controller unregistration can cause reference counters to decrement below zero, potentially leading to kernel crashes or instability. This affects Linux systems using SPI devices with devm resource management.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's SPI subsystem. When using devm_spi_alloc_* functions, improper cleanup during SPI controller unregistration can cause reference counters to decrement below zero, potentially leading to kernel crashes or instability. This affects Linux systems using SPI devices with devm resource management.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated, but patches were applied to stable kernel trees. Likely affects versions before the fix commits.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using SPI devices with devm_spi_alloc_master() or devm_spi_alloc_slave() functions.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially allowing privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System instability, kernel warnings, or crashes when SPI controllers are unregistered during device removal or driver unloading.

🟢

If Mitigated

Minor performance impact or warning messages in kernel logs without system compromise.

🌐 Internet-Facing: LOW - This requires local access or ability to trigger SPI device operations.

🏢 Internal Only: MEDIUM - Local users or processes with SPI device access could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering SPI controller cleanup, typically through device removal or driver operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees via provided git commits

Vendor Advisory: https://git.kernel.org/stable/c/001c8e83646ad3b847b18f6ac55a54367d917d74

Restart Required: Yes

Instructions:

1. Identify current kernel version. 2. Apply relevant kernel patch from stable tree. 3. Recompile kernel if using custom build. 4. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Avoid devm_spi_alloc functions

linux

Use non-devm SPI allocation functions if possible to avoid the vulnerable code path

🧯 If You Can't Patch

Restrict access to SPI device operations to trusted users only
Monitor kernel logs for refcount warnings and investigate SPI device operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if SPI devm allocation functions are used in your configuration

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits: 001c8e83646ad3b847b18f6ac55a54367d917d74 or related commits

📡 Detection & Monitoring

Log Indicators:

WARNING: CPU: ... at lib/refcount.c:28 refcount_warn_saturate
kobject_put errors during SPI operations
put_device warnings

SIEM Query:

kernel:WARNING AND refcount_warn_saturate

📊 Metadata

CVE ID: CVE-2021-46959

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: February 29, 2024

Last Updated: December 10, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-46959, you might also want to check these: