Description
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a timer callback is executing when lbs_free_adapter() is called, the callback will access freed memory since lbs_cfg_free() frees the containing structure immediately after lbs_free_adapter() returns. Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler) access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields, which would all be use-after-free violations. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. This bug was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had the same issue since the driver was first written.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
954ee164f4f4598afc172c0ec3865d0352e55a0b to < b15e0fa7adb4de3a03aee9e6fc4d83e5cf0a65e4affected954ee164f4f4598afc172c0ec3865d0352e55a0b to < 09f3c30ab3b1371eaf9676a1b8add57bca763083affected954ee164f4f4598afc172c0ec3865d0352e55a0b to < 3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dcaffected954ee164f4f4598afc172c0ec3865d0352e55a0b to < 3c5c818c78b03a1725f3dcd566865c77b48dd3a6affected954ee164f4f4598afc172c0ec3865d0352e55a0b to < d0155fe68f31b339961cf2d4f92937d57e9384e6affected954ee164f4f4598afc172c0ec3865d0352e55a0b to < ed7d30f90b77f73a47498686ede83f622b7e4f0daffected954ee164f4f4598afc172c0ec3865d0352e55a0b to < a9f55b14486426d907459bced5825a25063bd922affected954ee164f4f4598afc172c0ec3865d0352e55a0b to < 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0affected
Linux Linux
Default version status: affected
2.6.24affected0 to < 2.6.24unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.78 to ≤ 6.12.*unaffected6.18.17 to ≤ 6.18.*unaffected6.19.7 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b15e0fa7adb4de3a03aee9e6fc4d83e5cf0a65e4 ↗
- https://git.kernel.org/stable/c/09f3c30ab3b1371eaf9676a1b8add57bca763083 ↗
- https://git.kernel.org/stable/c/3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc ↗
- https://git.kernel.org/stable/c/3c5c818c78b03a1725f3dcd566865c77b48dd3a6 ↗
- https://git.kernel.org/stable/c/d0155fe68f31b339961cf2d4f92937d57e9384e6 ↗
- https://git.kernel.org/stable/c/ed7d30f90b77f73a47498686ede83f622b7e4f0d ↗
- https://git.kernel.org/stable/c/a9f55b14486426d907459bced5825a25063bd922 ↗
- https://git.kernel.org/stable/c/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗