Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3deff76095c4ac4252e27c537db3041f619c23a2 to < 5e8751a977a49a6e00cce1a8da5ca16da83f9c8caffected3deff76095c4ac4252e27c537db3041f619c23a2 to < f127c2b4c967025e5c3a4ce7e13b79135d46a33daffected3deff76095c4ac4252e27c537db3041f619c23a2 to < 0c8dd2ea4b419da96ab4953e4967e9363e2f8a4faffected3deff76095c4ac4252e27c537db3041f619c23a2 to < 988bd27de2484faf17afe0408db2e3d9e5ac61fcaffected3deff76095c4ac4252e27c537db3041f619c23a2 to < 98d9172822dc6f38138333941984bd759a89d419affected3deff76095c4ac4252e27c537db3041f619c23a2 to < 355f16f756aad0c95cdaa0c14a34ab4137d32815affected3deff76095c4ac4252e27c537db3041f619c23a2 to < 53b9bb1a00c4285ee7f58a11129dbea015db61bcaffected3deff76095c4ac4252e27c537db3041f619c23a2 to < 71fc0ad671a62c494d2aec731baeabd3bfe6c95daffected3deff76095c4ac4252e27c537db3041f619c23a2 to < dd95f2239fc846795fc926787c3ae0ca701c9840affected
Linux Linux
Default version status: affected
3.0affected0 to < 3.0unaffected4.9.337 to ≤ 4.9.*unaffected4.14.303 to ≤ 4.14.*unaffected4.19.270 to ≤ 4.19.*unaffected5.4.229 to ≤ 5.4.*unaffected5.10.163 to ≤ 5.10.*unaffected5.15.86 to ≤ 5.15.*unaffected6.0.16 to ≤ 6.0.*unaffected6.1.2 to ≤ 6.1.*unaffected6.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5e8751a977a49a6e00cce1a8da5ca16da83f9c8c ↗
- https://git.kernel.org/stable/c/f127c2b4c967025e5c3a4ce7e13b79135d46a33d ↗
- https://git.kernel.org/stable/c/0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f ↗
- https://git.kernel.org/stable/c/988bd27de2484faf17afe0408db2e3d9e5ac61fc ↗
- https://git.kernel.org/stable/c/98d9172822dc6f38138333941984bd759a89d419 ↗
- https://git.kernel.org/stable/c/355f16f756aad0c95cdaa0c14a34ab4137d32815 ↗
- https://git.kernel.org/stable/c/53b9bb1a00c4285ee7f58a11129dbea015db61bc ↗
- https://git.kernel.org/stable/c/71fc0ad671a62c494d2aec731baeabd3bfe6c95d ↗
- https://git.kernel.org/stable/c/dd95f2239fc846795fc926787c3ae0ca701c9840 ↗