Description
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 38e251d356a01b61a86cb35213cafd7e8fe7090caffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f520d181477ec29a496c0b3bbfbdb7e2606c2713affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2deb42c4f9776e59bee247c14af9c5e8c05ca9a6affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9ef353c92f9d04c88de3af1a46859c1fb76db0f8affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b0b83d3f3ffa96e8395c56b83d6197e184902a34affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5777432ebaaf797e24f059979b42df3139967163affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 0462fec709d51762ba486245bc344f44cc6cfa97affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 799881db3e03b5e98fe6a900d9d7de8c7d61e7eeaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 404ec60438add1afadaffaed34bb5fe4ddcadd40affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected4.9.337 to ≤ 4.9.*unaffected4.14.303 to ≤ 4.14.*unaffected4.19.270 to ≤ 4.19.*unaffected5.4.229 to ≤ 5.4.*unaffected5.10.163 to ≤ 5.10.*unaffected5.15.86 to ≤ 5.15.*unaffected6.0.16 to ≤ 6.0.*unaffected6.1.2 to ≤ 6.1.*unaffected6.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/38e251d356a01b61a86cb35213cafd7e8fe7090c ↗
- https://git.kernel.org/stable/c/f520d181477ec29a496c0b3bbfbdb7e2606c2713 ↗
- https://git.kernel.org/stable/c/2deb42c4f9776e59bee247c14af9c5e8c05ca9a6 ↗
- https://git.kernel.org/stable/c/9ef353c92f9d04c88de3af1a46859c1fb76db0f8 ↗
- https://git.kernel.org/stable/c/b0b83d3f3ffa96e8395c56b83d6197e184902a34 ↗
- https://git.kernel.org/stable/c/5777432ebaaf797e24f059979b42df3139967163 ↗
- https://git.kernel.org/stable/c/0462fec709d51762ba486245bc344f44cc6cfa97 ↗
- https://git.kernel.org/stable/c/799881db3e03b5e98fe6a900d9d7de8c7d61e7ee ↗
- https://git.kernel.org/stable/c/404ec60438add1afadaffaed34bb5fe4ddcadd40 ↗