Description
In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible use-after-free in HFC_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < 49331c07ef0f8fdfa42b30ba6a83a657b29d7fbeaffected87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < 54ff3202928952a100c477248e65ac6db01258a7affected87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < 7867ddc5f3de7f289aee63233afc0df4b62834c5affected87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < 5f2818185da0fe82a932f0856633038b66faf124affected87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < 3ecd228c636ee17c14662729737fa07242a93cb0affected87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802daffected87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < 61370ff07e0acc657559a8fac02551dfeb9d3020affected87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < ed7c3739d0a07e2ec3ccbffe7e93cea01c438cdaaffected87c5fa1bb42624254a2013cbbc3b170d6017f5d6 to < 009fc857c5f6fda81f2f7dd851b2d54193a8e733affected
Linux Linux
Default version status: affected
2.6.29affected0 to < 2.6.29unaffected4.4.276 to ≤ 4.4.*unaffected4.9.276 to ≤ 4.9.*unaffected4.14.240 to ≤ 4.14.*unaffected4.19.198 to ≤ 4.19.*unaffected5.4.133 to ≤ 5.4.*unaffected5.10.51 to ≤ 5.10.*unaffected5.12.18 to ≤ 5.12.*unaffected5.13.3 to ≤ 5.13.*unaffected5.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/49331c07ef0f8fdfa42b30ba6a83a657b29d7fbe ↗
- https://git.kernel.org/stable/c/54ff3202928952a100c477248e65ac6db01258a7 ↗
- https://git.kernel.org/stable/c/7867ddc5f3de7f289aee63233afc0df4b62834c5 ↗
- https://git.kernel.org/stable/c/5f2818185da0fe82a932f0856633038b66faf124 ↗
- https://git.kernel.org/stable/c/3ecd228c636ee17c14662729737fa07242a93cb0 ↗
- https://git.kernel.org/stable/c/b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802d ↗
- https://git.kernel.org/stable/c/61370ff07e0acc657559a8fac02551dfeb9d3020 ↗
- https://git.kernel.org/stable/c/ed7c3739d0a07e2ec3ccbffe7e93cea01c438cda ↗
- https://git.kernel.org/stable/c/009fc857c5f6fda81f2f7dd851b2d54193a8e733 ↗