Description
In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are allocated by input_allocate_device(), and assigned to sp->remote.mouse_dev and sp->remote.keybd_dev respectively. In the err_free_devices error branch of ibmasm_init_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_send_message error branch of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. My patch add a "error_init_remote" label to handle the error of ibmasm_init_remote_input_dev(), to avoid the uaf bugs.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
736ce43295682d060f2b93624b4a339f9af6aab1 to < 1512e7dc5eb08b7d92a12e2bfcd9cb8c4a1ec069affected736ce43295682d060f2b93624b4a339f9af6aab1 to < 29ba8e2ba89ee2862a26d91204dd5fe77ceee25aaffected736ce43295682d060f2b93624b4a339f9af6aab1 to < 5b06ca113bf197aab2ab61288f42506e0049fbabaffected736ce43295682d060f2b93624b4a339f9af6aab1 to < 481a76d4749ee3a27f902ba213fdcbb4bb39720eaffected736ce43295682d060f2b93624b4a339f9af6aab1 to < 38660031e80eaa6cc9370b031c180612f414b00daffected736ce43295682d060f2b93624b4a339f9af6aab1 to < b9c87ce3bc6331f82811a8cf8e930423c22523a3affected736ce43295682d060f2b93624b4a339f9af6aab1 to < ef1067d2baa847d53c9988510d99fb494de4d12caffected736ce43295682d060f2b93624b4a339f9af6aab1 to < a7268e8a227d5a4f0bd1584f556246b0224ab274affected736ce43295682d060f2b93624b4a339f9af6aab1 to < 7272b591c4cb9327c43443f67b8fbae7657dd9aeaffected
Linux Linux
Default version status: affected
2.6.16affected0 to < 2.6.16unaffected4.4.276 to ≤ 4.4.*unaffected4.9.276 to ≤ 4.9.*unaffected4.14.240 to ≤ 4.14.*unaffected4.19.198 to ≤ 4.19.*unaffected5.4.134 to ≤ 5.4.*unaffected5.10.52 to ≤ 5.10.*unaffected5.12.19 to ≤ 5.12.*unaffected5.13.4 to ≤ 5.13.*unaffected5.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1512e7dc5eb08b7d92a12e2bfcd9cb8c4a1ec069 ↗
- https://git.kernel.org/stable/c/29ba8e2ba89ee2862a26d91204dd5fe77ceee25a ↗
- https://git.kernel.org/stable/c/5b06ca113bf197aab2ab61288f42506e0049fbab ↗
- https://git.kernel.org/stable/c/481a76d4749ee3a27f902ba213fdcbb4bb39720e ↗
- https://git.kernel.org/stable/c/38660031e80eaa6cc9370b031c180612f414b00d ↗
- https://git.kernel.org/stable/c/b9c87ce3bc6331f82811a8cf8e930423c22523a3 ↗
- https://git.kernel.org/stable/c/ef1067d2baa847d53c9988510d99fb494de4d12c ↗
- https://git.kernel.org/stable/c/a7268e8a227d5a4f0bd1584f556246b0224ab274 ↗
- https://git.kernel.org/stable/c/7272b591c4cb9327c43443f67b8fbae7657dd9ae ↗