Description
In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use) Fix it by canceling the work before kfree.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
55742d2a071a569bf20f90d37b1b5b8a25a3f882 to < 74cd0a421896b2e07eafe7da4275302bfecef201affected55742d2a071a569bf20f90d37b1b5b8a25a3f882 to < 2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83affected55742d2a071a569bf20f90d37b1b5b8a25a3f882 to < fb071f5c75d4b1c177824de74ee75f9dd34123b9affected55742d2a071a569bf20f90d37b1b5b8a25a3f882 to < 9a733d69a4a59c2d08620e6589d823c24be773dcaffected55742d2a071a569bf20f90d37b1b5b8a25a3f882 to < 0b8fba38bdfb848fac52e71270b2aa3538c996eaaffected55742d2a071a569bf20f90d37b1b5b8a25a3f882 to < 03ea2b129344152157418929f06726989efc0445affected55742d2a071a569bf20f90d37b1b5b8a25a3f882 to < 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ceaffected
Linux Linux
Default version status: affected
4.9affected0 to < 4.9unaffected5.4.279 to ≤ 5.4.*unaffected5.10.221 to ≤ 5.10.*unaffected5.15.162 to ≤ 5.15.*unaffected6.1.95 to ≤ 6.1.*unaffected6.6.35 to ≤ 6.6.*unaffected6.9.6 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201 ↗
- https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83 ↗
- https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9 ↗
- https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dc ↗
- https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996ea ↗
- https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445 ↗
- https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗