CVSS 7.8 · High EPSS 0,16%
Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: media: si470x: Fix use-after-free in si470x_int_in_callback() syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called. The cause of this issue is that si470x_int_in_callback() is called for freed urb. si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn't kill urb, but it just frees struct si470x_device object, as depicted below: si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval < 0) free struct si470x_device object, but don't kill urb This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 3.6 hingga sebelum 4.9.337 |
| linux | linux kernel | Versi 4.10 hingga sebelum 4.14.303 |
| linux | linux kernel | Versi 4.15 hingga sebelum 4.19.270 |
| linux | linux kernel | Versi 4.20 hingga sebelum 5.4.229 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.163 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.86 |
| linux | linux kernel | Versi 5.16 hingga sebelum 6.0.16 |
| linux | linux kernel | Versi 6.1 hingga sebelum 6.1.2 |