Description
In the Linux kernel, the following vulnerability has been resolved: net: caif: clear client service pointer on teardown `caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer->dn`, but leaves that pointer stale. When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer. Clear the client/service links before releasing the service object so repeated teardown becomes harmless.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
43e3692101086add8719c3b8b50b05c9ac5b14e1 to < cffca7a18b8f9de7c3d3013a1f5740c412b2a501affected43e3692101086add8719c3b8b50b05c9ac5b14e1 to < 7ef97d4675b05a103648bd9244d91dff7d8c08b0affected43e3692101086add8719c3b8b50b05c9ac5b14e1 to < e16859f3f4426fa349bc5519d582a93d28f5a15daffected43e3692101086add8719c3b8b50b05c9ac5b14e1 to < 914c6456fcfc21a3d553945dff62fd1621d6155daffected43e3692101086add8719c3b8b50b05c9ac5b14e1 to < 3ac6db584d9d420267bb8413115707eeec76d9cfaffected43e3692101086add8719c3b8b50b05c9ac5b14e1 to < 63d21a3aa0108b9dde4e99b0d3d5d679ac68c0f9affected43e3692101086add8719c3b8b50b05c9ac5b14e1 to < a4b191ddc12c55ddb62feb096536f819f384d6f1affected43e3692101086add8719c3b8b50b05c9ac5b14e1 to < f7cf8ece8cee3c1ee361991470cdb1eb65ab02e8affected
Linux Linux
Default version status: affected
3.0affected0 to < 3.0unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.86 to ≤ 6.12.*unaffected6.18.27 to ≤ 6.18.*unaffected7.0.4 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/cffca7a18b8f9de7c3d3013a1f5740c412b2a501 ↗
- https://git.kernel.org/stable/c/7ef97d4675b05a103648bd9244d91dff7d8c08b0 ↗
- https://git.kernel.org/stable/c/e16859f3f4426fa349bc5519d582a93d28f5a15d ↗
- https://git.kernel.org/stable/c/914c6456fcfc21a3d553945dff62fd1621d6155d ↗
- https://git.kernel.org/stable/c/3ac6db584d9d420267bb8413115707eeec76d9cf ↗
- https://git.kernel.org/stable/c/63d21a3aa0108b9dde4e99b0d3d5d679ac68c0f9 ↗
- https://git.kernel.org/stable/c/a4b191ddc12c55ddb62feb096536f819f384d6f1 ↗
- https://git.kernel.org/stable/c/f7cf8ece8cee3c1ee361991470cdb1eb65ab02e8 ↗