CVSS 7.8 · High EPSS 0,13%
Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut CNA.
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 5.18 hingga sebelum 6.1.167 |
| linux | linux kernel | Versi 6.2 hingga sebelum 6.6.130 |
| linux | linux kernel | Versi 6.7 hingga sebelum 6.12.77 |
| linux | linux kernel | Versi 6.13 hingga sebelum 6.18.17 |
| linux | linux kernel | Versi 6.19 hingga sebelum 6.19.7 |
| linux | linux kernel | Versi 7.0 rc1 |