CVSS 7.8 · High EPSS 0,25%
Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; */ ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed <IRQ> ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 2.6.35 hingga sebelum 4.14.291 |
| linux | linux kernel | Versi 4.15 hingga sebelum 4.19.256 |
| linux | linux kernel | Versi 4.20 hingga sebelum 5.4.211 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.137 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.61 |
| linux | linux kernel | Versi 5.16 hingga sebelum 5.18.18 |
| linux | linux kernel | Versi 5.19 hingga sebelum 5.19.2 |