Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free: The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock), while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock. This allows concurrent execution. In omapfb_mmap(): 1. rg = omapfb_get_mem_region(ofbi->region); // Get old region ref 2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region 3. len = fix->smem_len; // Read from NEW region 4. vm_iomap_memory(vma, start, len); // Map NEW region memory 5. atomic_inc(&rg->map_count); // Increment OLD region! Concurrently, OMAPFB_SETUP_PLANE can: - Reassign ofbi->region = new_rg - Update fix->smem_len - OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it This leaves userspace with a mapping to freed physical memory. The fix is to read all required values (start, len) from the same region reference (rg) that will have its map_count incremented, preventing the region from being freed while still mapped.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
078ff546a806b2c2ab74c25c8edd4c6d4680656a to < a1a00f664a409b3412f9e1408c12890cffe50362affected078ff546a806b2c2ab74c25c8edd4c6d4680656a to < 5e10b1747547c3815e90d28166e92144835e065faffected078ff546a806b2c2ab74c25c8edd4c6d4680656a to < 986d5fafb73b8b866651399934b66d690f49135aaffected078ff546a806b2c2ab74c25c8edd4c6d4680656a to < 8363c219d88e78daaee5665117a0380442989338affected078ff546a806b2c2ab74c25c8edd4c6d4680656a to < 6eb6ebcc8590007ad59ddccc8b5f9201655b33f8affected078ff546a806b2c2ab74c25c8edd4c6d4680656a to < 7958e67375aa111522086286bba13cfc0816ce8daffected
Linux Linux
Default version status: affected
2.6.36affected0 to < 2.6.36unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.114 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.1.3 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a1a00f664a409b3412f9e1408c12890cffe50362 ↗
- https://git.kernel.org/stable/c/5e10b1747547c3815e90d28166e92144835e065f ↗
- https://git.kernel.org/stable/c/986d5fafb73b8b866651399934b66d690f49135a ↗
- https://git.kernel.org/stable/c/8363c219d88e78daaee5665117a0380442989338 ↗
- https://git.kernel.org/stable/c/6eb6ebcc8590007ad59ddccc8b5f9201655b33f8 ↗
- https://git.kernel.org/stable/c/7958e67375aa111522086286bba13cfc0816ce8d ↗