Description
In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free by calling del_timer_sync() This driver's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7c25f8c9f67708e6464d2221bc311cbd99e950dc to < 58606882ad8ec6c39e0f40344b922921ef94ab4daffected7c25f8c9f67708e6464d2221bc311cbd99e950dc to < ca96b8ea5e74956071154bdb456778cc3027e79faffected7c25f8c9f67708e6464d2221bc311cbd99e950dc to < 8bec568d7518b1504a602ed5376bb322e4dbb270affected7c25f8c9f67708e6464d2221bc311cbd99e950dc to < ecd620e0fb1ff7f78fdb593379b2e6938c99707aaffected7c25f8c9f67708e6464d2221bc311cbd99e950dc to < db222f1477ad5692cd454709b714949807e5d111affected7c25f8c9f67708e6464d2221bc311cbd99e950dc to < 66ba9cf929b1c4fabf545bd4c18f6f64e23e46e4affected7c25f8c9f67708e6464d2221bc311cbd99e950dc to < 4c05dac488a660fe2925c047ecb119e7afaaeb1eaffected7c25f8c9f67708e6464d2221bc311cbd99e950dc to < 1a053c4d716898a53c2e31c574a70ea0c37044a3affected7c25f8c9f67708e6464d2221bc311cbd99e950dc to < d0212f095ab56672f6f36aabc605bda205e1e0bfaffected
Linux Linux
Default version status: affected
4.3affected0 to < 4.3unaffected4.4.276 to ≤ 4.4.*unaffected4.9.276 to ≤ 4.9.*unaffected4.14.240 to ≤ 4.14.*unaffected4.19.198 to ≤ 4.19.*unaffected5.4.134 to ≤ 5.4.*unaffected5.10.52 to ≤ 5.10.*unaffected5.12.19 to ≤ 5.12.*unaffected5.13.4 to ≤ 5.13.*unaffected5.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/58606882ad8ec6c39e0f40344b922921ef94ab4d ↗
- https://git.kernel.org/stable/c/ca96b8ea5e74956071154bdb456778cc3027e79f ↗
- https://git.kernel.org/stable/c/8bec568d7518b1504a602ed5376bb322e4dbb270 ↗
- https://git.kernel.org/stable/c/ecd620e0fb1ff7f78fdb593379b2e6938c99707a ↗
- https://git.kernel.org/stable/c/db222f1477ad5692cd454709b714949807e5d111 ↗
- https://git.kernel.org/stable/c/66ba9cf929b1c4fabf545bd4c18f6f64e23e46e4 ↗
- https://git.kernel.org/stable/c/4c05dac488a660fe2925c047ecb119e7afaaeb1e ↗
- https://git.kernel.org/stable/c/1a053c4d716898a53c2e31c574a70ea0c37044a3 ↗
- https://git.kernel.org/stable/c/d0212f095ab56672f6f36aabc605bda205e1e0bf ↗