Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node" and then dereferences it on the next line. Two lines later, we take a mutex so I don't think this is an RCU safe region. Re-order it to do the dereferences before queuing up the free.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
68fbff68dbea35f9e6f7649dd22fce492a5aedac to < 5723120423a753a220b8b2954b273838b9d7e74aaffected68fbff68dbea35f9e6f7649dd22fce492a5aedac to < df2c071061ed52d2225d97b212d27ecedf456b8aaffected68fbff68dbea35f9e6f7649dd22fce492a5aedac to < c41b2941a024d4ec7c768e16ffb10a74b188fcedaffected68fbff68dbea35f9e6f7649dd22fce492a5aedac to < a8a63f27c3a8a3714210d32b12fd0f16d0337414affected68fbff68dbea35f9e6f7649dd22fce492a5aedac to < d9c70e93ec5988ab07ad2a92d9f9d12867f02c56affected
Linux Linux
Default version status: affected
5.14affected0 to < 5.14unaffected6.1.155 to ≤ 6.1.*unaffected6.6.109 to ≤ 6.6.*unaffected6.12.50 to ≤ 6.12.*unaffected6.16.10 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5723120423a753a220b8b2954b273838b9d7e74a ↗
- https://git.kernel.org/stable/c/df2c071061ed52d2225d97b212d27ecedf456b8a ↗
- https://git.kernel.org/stable/c/c41b2941a024d4ec7c768e16ffb10a74b188fced ↗
- https://git.kernel.org/stable/c/a8a63f27c3a8a3714210d32b12fd0f16d0337414 ↗
- https://git.kernel.org/stable/c/d9c70e93ec5988ab07ad2a92d9f9d12867f02c56 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗