Description
In the Linux kernel, the following vulnerability has been resolved: serial: caif: hold tty->link reference in ldisc_open and ser_release A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port. Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path. With this change applied, the reproducer no longer triggers the UAF in my testing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e31d5a05948e4478ba8396063d1e1f39880928e2 to < 23a3ac2e2262a291498567418227b99e1f3606b1affectede31d5a05948e4478ba8396063d1e1f39880928e2 to < 52135420e9f75853ea0c6cea7b736e3e98495f7daffectede31d5a05948e4478ba8396063d1e1f39880928e2 to < ca2ceba983bb23ea0202c2882d963253416654a3affectede31d5a05948e4478ba8396063d1e1f39880928e2 to < 8460187b4852fd00bd1c76394358053f3fa4d089affectede31d5a05948e4478ba8396063d1e1f39880928e2 to < 27e43356d0defb9fc7fa25265219a3ffeb7b3e98affectede31d5a05948e4478ba8396063d1e1f39880928e2 to < 35b58d3bc716ebb9ebd10fe1cac8c1177242511caffectede31d5a05948e4478ba8396063d1e1f39880928e2 to < 97a0bb491cae39478c6225381f14e9ac67b7bba7affectede31d5a05948e4478ba8396063d1e1f39880928e2 to < 288598d80a068a0e9281de35bcb4ce495f189e2aaffected
Linux Linux
Default version status: affected
2.6.35affected0 to < 2.6.35unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.78 to ≤ 6.12.*unaffected6.18.19 to ≤ 6.18.*unaffected6.19.9 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/23a3ac2e2262a291498567418227b99e1f3606b1 ↗
- https://git.kernel.org/stable/c/52135420e9f75853ea0c6cea7b736e3e98495f7d ↗
- https://git.kernel.org/stable/c/ca2ceba983bb23ea0202c2882d963253416654a3 ↗
- https://git.kernel.org/stable/c/8460187b4852fd00bd1c76394358053f3fa4d089 ↗
- https://git.kernel.org/stable/c/27e43356d0defb9fc7fa25265219a3ffeb7b3e98 ↗
- https://git.kernel.org/stable/c/35b58d3bc716ebb9ebd10fe1cac8c1177242511c ↗
- https://git.kernel.org/stable/c/97a0bb491cae39478c6225381f14e9ac67b7bba7 ↗
- https://git.kernel.org/stable/c/288598d80a068a0e9281de35bcb4ce495f189e2a ↗