LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47334: misc/libmasm/module: Fix two use after free in ibmasm_init_one

In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are allocated by input_allocate_device(), and assigned to sp->remote.mouse_dev and sp->remote.keybd_dev respectively. In the err_free_devices error branch of ibmasm_init_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_send_message error branch of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. My patch add a "error_init_remote" label to handle the error of ibmasm_init_remote_input_dev(), to avoid the uaf bugs.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-47334 is a Linux kernel use-after-free flaw in the ibmasm module’s error handling. If device initialization fails, the kernel can later act on already freed remote mouse and keyboard input objects. The public sources do not provide CVSS, CWE, or confirmed exploitation evidence.

Executive priority

Treat as a routine kernel maintenance item unless asset inventory shows broad use of affected kernels with the ibmasm module. No active exploitation is documented in the provided sources, but kernel memory-safety issues still warrant timely patch validation.

Technical view

The bug is in ibmasm_init_one. After ibmasm_init_remote_input_dev allocates mouse_dev and keybd_dev, an error branch can free them, then a later branch calls ibmasm_free_remote_input_dev on the freed pointers. Kernel stable commits add a separate error_init_remote path to avoid the double cleanup.

Likely exposure

Exposure is limited to Linux kernels identified in the CVE record where the ibmasm module code is present and reachable. Distribution kernels may have backported fixes, so version strings alone are not enough to determine exposure.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation, public weaponization, or practical attack prerequisites. The documented impact is a kernel use-after-free during an initialization failure path.

Researcher notes

Evidence is limited to the CVE record and Linux stable commit references. The record identifies a resolved use-after-free and fix approach, but does not include CVSS, CWE, exploitability analysis, or distro-specific package status.

Mitigation direction

  • Check vendor kernel advisories for CVE-2021-47334 applicability.
  • Update to a kernel containing the referenced stable fix commits.
  • Confirm whether distribution backports already include the fix.
  • Prioritize systems where the ibmasm module is present or loaded.

Validation and detection

  • Inventory Linux kernel versions across affected systems.
  • Check vendor changelogs for CVE-2021-47334 or the referenced commits.
  • Determine whether the ibmasm module exists and can load.
  • Verify patched kernels no longer contain the vulnerable cleanup path.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47334 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux736ce43295682d060f2b93624b4a339f9af6aab1, 736ce43295682d060f2b93624b4a339f9af6aab1, 736ce43295682d060f2b93624b4a339f9af6aab1, 736ce43295682d060f2b93624b4a339f9af6aab1, 736ce43295682d060f2b93624b4a339f9af6aab1, 736ce43295682d060f2b93624b4a339f9af6aab1, 736ce43295682d060f2b93624b4a339f9af6aab1, 736ce43295682d060f2b93624b4a339f9af6aab1, 736ce43295682d060f2b93624b4a339f9af6aab1unaffected
LinuxLinux2.6.16, 0, 4.4.276, 4.9.276, 4.14.240, 4.19.198, 5.4.134, 5.10.52, 5.12.19, 5.13.4, 5.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.