CVE-2021-46933

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.

ffs_data_clear is indirectly called from both ffs_fs_kill_sb and

ffs_ep0_release, so it ends up being called twice when userland closes ep0

and then unmounts f_fs.

If userland provided an eventfd along with function's USB descriptors, it

ends up calling eventfd_ctx_put as many times, causing a refcount

underflow.

NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.

Also, set epfiles to NULL right after de-allocating it, for readability.

For completeness, ffs_data_clear actually ends up being called thrice, the

last call being before the whole ffs structure gets freed, so when this

specific sequence happens there is a second underflow happening (but not

being reported):

/sys/kernel/debug/tracing# modprobe usb_f_fs

/sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter

/sys/kernel/debug/tracing# echo function > current_tracer

/sys

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References