Description
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted TMF sas_task Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout. When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task(). However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
968ee9176a4489ce6d5ee54ff88dadfbff9b95f4 to < d872e7b5fe38f325f5206b6872746fa02c2b4819affectedd712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to < 3c334cdfd94945b8edb94022a0371a8665b17366affectedd712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to < 510b21442c3a2e3ecc071ba3e666b320e7acdd61affectedd712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to < 61f162aa4381845acbdc7f2be4dfb694d027c018affectedfa3c19ceaa8b4b7c29d710c2c407df57d256a6c5affected5.10.61 to < 5.10.102affected5.13.13 to < 5.14affected
Linux Linux
Default version status: affected
5.14affected0 to < 5.14unaffected5.10.102 to ≤ 5.10.*unaffected5.15.25 to ≤ 5.15.*unaffected5.16.11 to ≤ 5.16.*unaffected5.17 to ≤ *unaffected