Description
In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
451d8123f89791bb628277c0bdb4cae34a3563e6 to < ddf4e04e946aaa6c458b8b6829617cc44af2bffdaffected451d8123f89791bb628277c0bdb4cae34a3563e6 to < a1a485e45d24b1cd8fe834fd6f1b06e2903827daaffected451d8123f89791bb628277c0bdb4cae34a3563e6 to < 6086258bd5ea7b5c706ff62da42b8e271b2401dbaffected451d8123f89791bb628277c0bdb4cae34a3563e6 to < 1787b9f0729d318d67cf7c5a95f0c3dba9a7cc18affected451d8123f89791bb628277c0bdb4cae34a3563e6 to < d103fb6726904e353b4773188ee3d3acb4078363affected451d8123f89791bb628277c0bdb4cae34a3563e6 to < 876f8ab52363f649bcc74072157dfd7adfbabc0daffected
Linux Linux
Default version status: affected
5.9affected0 to < 5.9unaffected5.10.201 to ≤ 5.10.*unaffected5.15.139 to ≤ 5.15.*unaffected6.1.63 to ≤ 6.1.*unaffected6.5.12 to ≤ 6.5.*unaffected6.6.2 to ≤ 6.6.*unaffected6.7 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ddf4e04e946aaa6c458b8b6829617cc44af2bffd ↗
- https://git.kernel.org/stable/c/a1a485e45d24b1cd8fe834fd6f1b06e2903827da ↗
- https://git.kernel.org/stable/c/6086258bd5ea7b5c706ff62da42b8e271b2401db ↗
- https://git.kernel.org/stable/c/1787b9f0729d318d67cf7c5a95f0c3dba9a7cc18 ↗
- https://git.kernel.org/stable/c/d103fb6726904e353b4773188ee3d3acb4078363 ↗
- https://git.kernel.org/stable/c/876f8ab52363f649bcc74072157dfd7adfbabc0d ↗