Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure. Fix this by releasing the spinlock before calling complete().
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e48354ce078c079996f89d715dfa44814b4eba01 to < ba684191437380a07b27666eb4e72748be1ea201affectede48354ce078c079996f89d715dfa44814b4eba01 to < 8518f072fc92921418cd9ed4268dd4f3e9a8fd75affectede48354ce078c079996f89d715dfa44814b4eba01 to < 275016a551ba1a068a3bd6171b18611726b67110affectede48354ce078c079996f89d715dfa44814b4eba01 to < 73b487d44bf4f92942629d578381f89c326ff77faffectede48354ce078c079996f89d715dfa44814b4eba01 to < 48fe983e92de2c59d143fe38362ad17ba23ec7f3affectede48354ce078c079996f89d715dfa44814b4eba01 to < 3835e49e146a4e6e7787b29465f1a23379b6ec44affectede48354ce078c079996f89d715dfa44814b4eba01 to < 9411a89e9e7135cc459178fa77a3f1d6191ae903affected
Linux Linux
Default version status: affected
3.1affected0 to < 3.1unaffected5.10.250 to ≤ 5.10.*unaffected5.15.200 to ≤ 5.15.*unaffected6.1.163 to ≤ 6.1.*unaffected6.6.124 to ≤ 6.6.*unaffected6.12.70 to ≤ 6.12.*unaffected6.18.10 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201 ↗
- https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75 ↗
- https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110 ↗
- https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f ↗
- https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3 ↗
- https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44 ↗
- https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903 ↗