Description
In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and work before freeing context llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races. Stop all SHDLC timers and cancel sm_work synchronously before purging the queues and freeing the context. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
4a61cd6687fc6348d08724676d34e38160d6cf9b to < c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6eaffected4a61cd6687fc6348d08724676d34e38160d6cf9b to < a24a676329d40481b2331bfa1418a679577dfd3aaffected4a61cd6687fc6348d08724676d34e38160d6cf9b to < 77eef9f2eef045c3c37a3df82d3e661afb866b98affected4a61cd6687fc6348d08724676d34e38160d6cf9b to < cf70cedce327833296ebe6043364d1e44b76a2abaffected4a61cd6687fc6348d08724676d34e38160d6cf9b to < 276820278e9717cc7d4bb32381892dd3ddf418d4affected4a61cd6687fc6348d08724676d34e38160d6cf9b to < 1cb97b1225450af3f7b728777929ba50c6a58cedaffected4a61cd6687fc6348d08724676d34e38160d6cf9b to < c9efde1e537baed7648a94022b43836a348a074faffected
Linux Linux
Default version status: affected
3.7affected0 to < 3.7unaffected5.15.202 to ≤ 5.15.*unaffected6.1.165 to ≤ 6.1.*unaffected6.6.128 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.14 to ≤ 6.18.*unaffected6.19.4 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e ↗
- https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a ↗
- https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98 ↗
- https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab ↗
- https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4 ↗
- https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced ↗
- https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f ↗