Description
In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called. To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs. The fix is easy, don't use devres in this case. Found during my research about object lifetime problems.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 to < 97a2d55ead76358245b446efd87818e919196d7aaffected7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 to < b788ad3b2468512339c05f23692e36860264e674affected7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 to < 3ff54d904fafabd0912796785e53cce4e69ca123affected7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 to < 5b7d5c2dd664eb8b9a06ecbc06e28d39359c422eaffected7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 to < af5818c35173e096085c6ae2e3aac605d3d15e41affected7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 to < 2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8eaffected7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 to < 55c91fedd03d7b9cf0c5199b2eb12b9b8e95281aaffected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected4.19.293 to ≤ 4.19.*unaffected5.4.255 to ≤ 5.4.*unaffected5.10.192 to ≤ 5.10.*unaffected5.15.128 to ≤ 5.15.*unaffected6.1.47 to ≤ 6.1.*unaffected6.4.12 to ≤ 6.4.*unaffected6.5 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/97a2d55ead76358245b446efd87818e919196d7a ↗
- https://git.kernel.org/stable/c/b788ad3b2468512339c05f23692e36860264e674 ↗
- https://git.kernel.org/stable/c/3ff54d904fafabd0912796785e53cce4e69ca123 ↗
- https://git.kernel.org/stable/c/5b7d5c2dd664eb8b9a06ecbc06e28d39359c422e ↗
- https://git.kernel.org/stable/c/af5818c35173e096085c6ae2e3aac605d3d15e41 ↗
- https://git.kernel.org/stable/c/2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8e ↗
- https://git.kernel.org/stable/c/55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a ↗