Description
In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f2451def095c1743adcfcb0cb5dadc86034e162a to < 902120be4f44947df6311002addc7faf69bdbff1affecteda1f93804449d13f97dabd4b996817de4bf1ed67a to < a6d57084372161f86660bc4607784420e00efe2caffected58c9b016e12855286370dfb704c08498edbc857a to < a6566cd33f6f967a7651ebf2ce0dd31572e319cfaffected58c9b016e12855286370dfb704c08498edbc857a to < 5b1173b165421561db29f30afc7e97d940a398a9affected58c9b016e12855286370dfb704c08498edbc857a to < 7e8083f5eeedab0f460063b9c2c14c9a4e71a427affected58c9b016e12855286370dfb704c08498edbc857a to < ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322affected58c9b016e12855286370dfb704c08498edbc857a to < 07712db80857d5d09ae08f3df85a708ecfc3b61faffected
Linux Linux
Default version status: affected
6.4affected0 to < 6.4unaffected6.6.136 to ≤ 6.6.*unaffected6.12.83 to ≤ 6.12.*unaffected6.18.24 to ≤ 6.18.*unaffected6.19.14 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/902120be4f44947df6311002addc7faf69bdbff1 ↗
- https://git.kernel.org/stable/c/a6d57084372161f86660bc4607784420e00efe2c ↗
- https://git.kernel.org/stable/c/a6566cd33f6f967a7651ebf2ce0dd31572e319cf ↗
- https://git.kernel.org/stable/c/5b1173b165421561db29f30afc7e97d940a398a9 ↗
- https://git.kernel.org/stable/c/7e8083f5eeedab0f460063b9c2c14c9a4e71a427 ↗
- https://git.kernel.org/stable/c/ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322 ↗
- https://git.kernel.org/stable/c/07712db80857d5d09ae08f3df85a708ecfc3b61f ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗