CVSS 7.8 · High EPSS 0,20%
Kerentanan Use After Free pada linux kernel, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs interface. This could make UAF issue in below scenario: CPU0 CPU1 (sysfs enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() unload module // access to config_desc which freed // while unloading module. cscfg_csdev_enable_config To address this, use cscfg_config_desc's active_cnt as a reference count which will be holded when - activate the config. - enable the activated config. and put the module reference when config_active_cnt == 0.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 5.15 hingga sebelum 6.1.142 |
| linux | linux kernel | Versi 6.2 hingga sebelum 6.6.94 |
| linux | linux kernel | Versi 6.7 hingga sebelum 6.12.34 |
| linux | linux kernel | Versi 6.13 hingga sebelum 6.15.3 |
| debian | debian linux | Versi 11.0 |