CVE-2021-47583

media: mxl111sf: change mutex_init() location

MEDIUM
5.5
CVSS Score
Published: June 19, 2024 at 02:53 PM UTC
Updated: June 17, 2026 at 04:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutex_init() location Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was in wrong mutex_init() location. Previous mutex_init(&state->msg_lock) call was in ->init() function, but dvb_usbv2_init() has this order of calls: dvb_usbv2_init() dvb_usbv2_adapter_init() dvb_usbv2_adapter_frontend_init() props->frontend_attach() props->init() Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach() internally we need to initialize state->msg_lock before frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_* devices, which will simply initiaize mutex.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.7 ≤ v < 4.19.2223.7 ≤ v < 5.10.883.7 ≤ v < 5.15.113.7 ≤ v < 5.163.7 ≤ v < 5.4.1684.20 ≤ v < 5.4.1685.11 ≤ v < 5.15.115.5 ≤ v < 5.10.883.78572211842afc53c8450fb470f2b8d02ba7592e0
Vendor states this is fixed in 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f (fixed)
Vendor states this is fixed in 4b2d9600b31f9ba7adbc9f3c54a068615d27b390 (fixed)
Vendor states this is fixed in 8c6fdf62bfe1bc72bfceeaf832ef7499c7ed09ba (fixed)
Vendor states this is fixed in 96f182c9f48b984447741f054ec301fdc8517035 (fixed)
Vendor states this is fixed in b99bdf127af91d53919e96292c05f737c45ea59a (fixed)
Vendor states this is fixed in 3.7 (unaffected)
Vendor states this is fixed in 4.19.222 (unaffected)
Vendor states this is fixed in 5.10.88 (unaffected)
Vendor states this is fixed in 5.15.11 (unaffected)
Vendor states this is fixed in 5.16 (unaffected)
Vendor states this is fixed in 5.4.168 (unaffected)

References (5)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4b2d9600b31f9ba7adbc9f3c54a068615d27b390
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8c6fdf62bfe1bc72bfceeaf832ef7499c7ed09ba
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/96f182c9f48b984447741f054ec301fdc8517035
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b99bdf127af91d53919e96292c05f737c45ea59a

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-908

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card