Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2023-53459

HID: mcp-2221: prevent UAF in delayed work

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: HID: mcp-2221: prevent UAF in delayed work If the device is plugged/unplugged without giving time for mcp_init_work() to complete, we might kick in the devm free code path and thus have unavailable struct mcp_2221 while in delayed work. Canceling the delayed_work item is enough to solve the issue, because cancel_delayed_work_sync will prevent the work item to requeue itself.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 960f9df7c620ecb6030aff1d9a6c3d67598b8290 to < 5dc297652dbc557eba7ca7d6a4c5f1940dffffb1affected
  • 960f9df7c620ecb6030aff1d9a6c3d67598b8290 to < 47e91fdfa511139f2549687edb0d8649b123227baffected

Linux Linux

Default version status: affected

  • 6.2affected
  • 0 to < 6.2unaffected
  • 6.2.1 to ≤ 6.2.*unaffected
  • 6.3 to ≤ *unaffected

References